@modelcontextprotocol/sdk
1.32.1 · 5 Oct 2026MIT39.4M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @modelcontextprotocol/sdk. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 1.32.1 | Safe from 1.32.0 | |
| 0.7.0 | 8 open advisories, worst high · last release Nov 2024, no longer updated |
- HighMCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationGHSA-46jr-4wx8-v453 · 20 Oct 2026
- 1.x1.3.0 – 1.31.0Fixed in 1.32.0
- HighMCP TypeScript SDK: Experimental tasks were not tied to the session that created themGHSA-22jm-h49p-29qw · 20 Oct 2026
- 1.x1.24.0 – 1.31.0Fixed in 1.32.0
- HighMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverGHSA-6qxp-vccf-f47h · 6 Oct 2026
- 1.x1.12.0 – 1.30.1Fixed in 1.31.0
- High@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseGHSA-345p-7cg4-v4c7 · 4 Feb 2026
- 1.x1.10.0 – 1.25.3Fixed in 1.26.0
- HighAnthropic's MCP TypeScript SDK has a ReDoS vulnerabilityGHSA-8r9q-7v3j-jr4g · 5 Jan 2026
- 1.x1.3.0 – 1.25.1Fixed in 1.25.2
- HighModel Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultGHSA-w48q-cv73-mx4w · 2 Dec 2025
- 1.x1.0.0 – 1.23.1Fixed in 1.24.0
- 0.7.x and older0.4.0 – 0.7.0No fix, no longer updated · move to 1.24.0
- ModerateMCP TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceGHSA-rvq5-wwqv-78pq · 20 Oct 2026
- 1.x1.6.0 – 1.31.0Fixed in 1.32.0
- Moderate
- 1.x1.0.0 – 1.31.0Fixed in 1.32.0
- 0.7.x and older0.4.0 – 0.7.0No fix, no longer updated · move to 1.32.0
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.