# Ten security advisories hit the official MCP SDKs in eight days

> Source: <https://github.com/modelcontextprotocol/typescript-sdk/security/advisories>
> Published: 2026-10-05 00:00:00+00:00

## Repository navigation

# Security: modelcontextprotocol/typescript-sdk

## Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

- 
          [OAuth client could send credentials to an authorization server chosen by the MCP server](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h)
        GHSA-6qxp-vccf-f47h publishedSep 30, 2026 by[maxisbey](https://github.com/maxisbey) High
- 
          [Server bearer authentication accepted tokens issued for another service](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq)
        GHSA-rvq5-wwqv-78pq publishedOct 5, 2026 by[maxisbey](https://github.com/maxisbey) Moderate
- 
          [Experimental tasks were not tied to the session that created them](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw)
        GHSA-22jm-h49p-29qw publishedOct 2, 2026 by[maxisbey](https://github.com/maxisbey) High
- 
          [Shared transport or server instances delivered one HTTP client's messages to another](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp)
        GHSA-jm63-cq47-j5jp publishedOct 15, 2026 by[maxisbey](https://github.com/maxisbey) High
- 
          [HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw)
        GHSA-6prh-2h8m-c8cw publishedOct 2, 2026 by[maxisbey](https://github.com/maxisbey) Moderate
- 
          [One HTTP request within the default size limit could exhaust server memory during validation](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453)
        GHSA-46jr-4wx8-v453 publishedOct 15, 2026 by[maxisbey](https://github.com/maxisbey) High
- 
          [HTTP server transports and handlers did not limit request body size or JSON-RPC batch length](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq)
        GHSA-f897-62hf-6gxq publishedOct 15, 2026 by[maxisbey](https://github.com/maxisbey) High
- 
          [Sharing server/transport instances can leak cross-client response data](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7)
        GHSA-345p-7cg4-v4c7 publishedFeb 4, 2026 by[pcarleton](https://github.com/pcarleton) High
- 
          [Regular Expression Denial of Service (ReDoS) in UriTemplate](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-cqwc-fm46-7fff)
        GHSA-cqwc-fm46-7fff publishedJan 7, 2026 by[pcarleton](https://github.com/pcarleton) High
- 
          [DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w)
        GHSA-w48q-cv73-mx4w publishedDec 2, 2025 by[pcarleton](https://github.com/pcarleton) High