npm MCP Server CVE-2026-111770 Cross-Client Data Leak in Shared HTTP Instances

The npm package @modelcontextprotocol/server contains a high-severity vulnerability that exposes client data to other users. GitHub advisory GHSA-jm63-cq47-j5jp identifies the issue as a cross-client data leakage flaw. Environments using HTTP endpoints with shared server instances are exposed to this risk. Security teams should verify if their deployments match the affected configuration patterns described in the advisory.

Root cause

The vulnerability stems from how the server matches incoming messages to specific connections. According to the advisory, the software relies solely on JSON-RPC `id` fields for this matching process. SDK clients typically number requests starting from zero, which causes ID collisions during normal operation. This design flaw allows the server to deliver responses and notifications intended for one client to a different client sharing the same transport or server instance.

Attack path

An attacker needs to connect to the same HTTP endpoint as a legitimate user. The advisory states that the flaw activates when clients share a stateless transport or a single `McpServer` instance. Because message IDs collide, the server cannot distinguish between the two connections. Consequently, the attacker may receive data meant for the other client. This exposure occurs in standard configurations where the server is instantiated once at startup rather than per request.

Affected versions

• @modelcontextprotocol/server versions 2.0.0 through 2.2.0 are vulnerable
• @modelcontextprotocol/sdk version 1.26.0 and later are not affected
• Stdio servers are not affected by this specific HTTP transport flaw
• Configurations using createMcpHandler() with a factory pattern are not affected

Mitigation

• Upgrade to @modelcontextprotocol/server version 2.3.0 or later
• Refactor code to use createMcpHandler() with a factory that builds a new server per call
• Create a new McpServer and transport inside each request handler
• Implement per-session handling by setting sessionIdGenerator to maintain separate instances

Detection notes

Security operations teams should monitor HTTP access logs for unusual patterns of concurrent connections to the same MCP endpoint. Look for responses containing data that does not match the requesting client's expected session context. Alert on rapid succession of JSON-RPC requests with identical or low sequence IDs from different source IPs. Check whether application logs show connection reuse warnings or errors related to already connected states. Verify that server instances are not being shared across distinct user sessions in the application code.

What to do and how to stay safe: Model Context Protocol

• Audit your server initialization code to ensure you are not creating a single server instance for multiple HTTP requests
• Monitor network traffic for unexpected data exchanges between clients connected to the same MCP endpoint
• Update your dependency management policies to automatically install security patches for critical npm packages
• Review your application architecture to confirm that each client session uses a dedicated server instance

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect stdio-based Model Context Protocol servers?

No, the advisory states that stdio servers are not affected by this specific HTTP transport vulnerability.

Can I fix this issue without upgrading the package version?

Yes, the advisory notes that refactoring your code to create new server instances per request or session fixes the issue even in older versions.

Which npm package versions are vulnerable to CVE-2026-111770?

Versions 2.0.0 through 2.2.0 of the @modelcontextprotocol/server package are affected by this vulnerability.