TY
Product
typescript-sdk
4
CVEs
0
On KEV
8.6
Max CVSS
2
New 30D
Severity mix
Critical 0High 4Medium 0Low 0
Watch
Add typescript-sdk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111767 | 8.6 | Oct 20 | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them Affected: >= 1.24.0, < 1.32.0 |
| CVE-2025-66414 | 8.1 | Dec 2 | DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost Affected: < 1.24.0 |
| CVE-2026-104850 | 7.5 | Oct 6 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server Affected: >= 1.12.0, < 1.31.0; >= 2.0.0, < 2.2.0 |
| CVE-2026-25536 | 7.1 | Feb 4 | @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse Affected: >= 1.10.0, < 1.26.0 |
Showing 4