p PatchFirst

PatchFirst · Latest vulnerabilities

mcp-handler vulnerabilities

Vulnerabilities published for mcp-handler in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-w2fm-25vw-vh7f

    High · CVSS 7.1Fix available

    mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

    `mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a `StreamableHTTPServerTransport` instance is reused across requests. **Note:** This is _not_ a vulnerability in `mcp-handler` itself. The root cause is in the peer dependency `@modelcontextprotocol/sdk`. ### Impact A low-privileged attacker making concurrent requests to an `mcp-han

    mcp-handlerNode.js
    • Update to 1.1.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →