GHSA-w2fm-25vw-vh7f
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.
Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.
Impact
A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.
Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.
Patches
Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.
Workarounds
- Upgrade
@modelcontextprotocol/sdkto>=1.26.0(note: the SDK will throw on transport reuse, which will breakmcp-handler< 1.1.0 which effectively forces the upgrade) - Alternatively, manually create fresh
McpServerand transport instances per request in your handler code
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.
Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.
Impact
A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.
Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.
Patches
Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.
Workarounds
- Upgrade
@modelcontextprotocol/sdkto>=1.26.0(note: the SDK will throw on transport reuse, which will breakmcp-handler< 1.1.0 which effectively forces the upgrade) - Alternatively, manually create fresh
McpServerand transport instances per request in your handler code
- Record
GHSA-w2fm-25vw-vh7f- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-362, CWE-1395
- Updated
- 2026-11-02
OSV
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.
Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.
Impact
A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.
Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.
Patches
Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.
Workarounds
- Upgrade
@modelcontextprotocol/sdkto>=1.26.0(note: the SDK will throw on transport reuse, which will breakmcp-handler< 1.1.0 which effectively forces the upgrade) - Alternatively, manually create fresh
McpServerand transport instances per request in your handler code
- Record
GHSA-w2fm-25vw-vh7f- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-1395, CWE-362
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mcp-handlernpm | before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-w2fm-25vw-vh7f is a high vulnerability (CVSS 7.1) in mcp-handler, published April 1, 2026. No source lists public exploit code. Fixed in mcp-handler 1.1.0.