@modelcontextprotocol/client
2.3.1 · 5 Oct 2026Apache-2.04.7M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @modelcontextprotocol/client. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.3.1 | Safe from 2.3.0 |
- HighMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverGHSA-6qxp-vccf-f47h · 6 Oct 2026
- 2.x2.0.0 – 2.1.0Fixed in 2.2.0
- Moderate
- 2.x2.0.0 – 2.2.0Fixed in 2.3.0
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.