UpHeron
All vulnerabilities

npm

CVE-2026-111767

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Severity
High 8.6
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.32.0
Also known as
GHSA-22jm-h49p-29qw
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
@modelcontextprotocol/sdknpm · osv:npm:@modelcontextprotocol/sdk
  • From 1.24.0 before 1.32.0

References