UpHeron
All vulnerabilities

npm

CVE-2026-111771

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Severity
Medium 6.8
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.32.0, 2.0.2, 2.3.0, 2.3.1
Also known as
GHSA-rvq5-wwqv-78pq
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
@modelcontextprotocol/expressnpm · osv:npm:@modelcontextprotocol/express
  • From 2.0.0 before 2.0.2
@modelcontextprotocol/sdknpm · osv:npm:@modelcontextprotocol/sdk
  • From 1.6.0 before 1.32.0
@modelcontextprotocol/servernpm · osv:npm:@modelcontextprotocol/server
  • From 2.0.0 before 2.3.0
@modelcontextprotocol/server-legacynpm · osv:npm:@modelcontextprotocol/server-legacy
  • From 2.0.0 before 2.3.1

References