CVE-2026-25536
Fixed in a distro release EPSS <1%CVSS 7.1
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
Products: modelcontextprotocol typescript-sdk, Red Hat Ansible Automation Platform 2.6
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @modelcontextprotocol/sdk | 1.26.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gemini-cli | 0.49.0-r4 |
| Chainguard | kibana-9.1 | 9.1.10-r4 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r4 |
| Chainguard | kibana-9.2 | 9.2.5-r0 |
| Chainguard | kibana-9.2-iamguarded | 9.2.5-r0 |
| Chainguard | langfuse-3 | 3.153.0-r0 |
| Chainguard | langfuse-3-worker | 3.153.0-r0 |
| Chainguard | langfuse-fips-3 | 3.152.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.152.0-r0 |
| Chainguard | librechat | 0.8.2-r2 |
| Chainguard | opensearch-dashboards-2 | 2.19.4-r8 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.4-r8 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.4-r9 |
| Wolfi | langfuse-3 | 3.153.0-r0 |
| Wolfi | langfuse-3-worker | 3.153.0-r0 |