Executive brief
mcp-handler is a Node.js library for handling Model Context Protocol requests. In versions prior to 1.1.0, concurrent requests from different users to the same server endpoint can inadvertently share authentication credentials and tool execution results due to unsafe reuse of transport instances, allowing one user to access another's session data and results.
Technical details
The vulnerability is a race condition (CWE-362) caused by a dependency issue in the peer dependency @modelcontextprotocol/sdk < 1.26.0. When a StreamableHTTPServerTransport instance is reused across concurrent client connections, server-side state—including authentication context and tool execution results—is shared between independent client sessions. An attacker with low privilege making concurrent requests can exploit the timing window to read another client's session data. This is fundamentally a vulnerability in the SDK (CVE-2026-25536), but mcp-handler < 1.1.0 accepts the vulnerable SDK version as a peer dependency, making applications using mcp-handler susceptible. The fix is to upgrade mcp-handler to 1.1.0, which requires @modelcontextprotocol/sdk@>=1.26.0.
Affected products
- Vercel mcp-handler < 1.1.0
- Vercel @modelcontextprotocol/sdk < 1.26.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: mcp-handler 1.1.0 released