p PatchFirst

PatchFirst · Latest vulnerabilities

@modelcontextprotocol/express vulnerabilities

Vulnerabilities published for @modelcontextprotocol/express in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2026-111771

    Medium · CVSS 6.8Fix available

    MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

    ### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself. Affected versions: - `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0 - `@modelcontextprotocol/server` 2.0.0 t

    @modelcontextprotocol/expressNode.js
    • Update to 2.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →