MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
### Summary
In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance.
Messages were matched to a connection by JSON-RPC `id` alone. SDK clients number requests from 0, so ids collide in normal use.
### Am I affected?
Yes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, instead of once per request or per session. Until this release, the README examples of `@modelcontextprotocol/hono`, `express`, `fastify
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
### Summary
In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.
No credentials are needed, unless you authenticate requests before they reach the SDK.
### Am I affected?
Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected.
Affected versions:
- `@modelcontextprotocol/sdk` 1.3.0 through 1.31
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
### Summary
In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.
### Am I affected?
Yes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.
Affected versions:
- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0
- `@modelcontextprotocol/server` 2.0.0 t