@modelcontextprotocol/server
2.3.1 · 5 Oct 2026Apache-2.08.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @modelcontextprotocol/server. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.3.1 | Safe from 2.3.0 |
- HighMCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to anotherGHSA-jm63-cq47-j5jp · 20 Oct 2026
- 2.x2.0.0 – 2.2.0Fixed in 2.3.0
- HighMCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationGHSA-46jr-4wx8-v453 · 20 Oct 2026
- 2.x2.0.0 – 2.2.0Fixed in 2.3.0
- ModerateMCP TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceGHSA-rvq5-wwqv-78pq · 20 Oct 2026
- 2.x2.0.0 – 2.2.0Fixed in 2.3.0
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.