GHSA-W2FM-25VW-VH7F
Vulnerability from github – Published: 2026-04-01 23:58 – Updated: 2026-04-01 23:58mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.
Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.
Impact
A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.
Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.
Patches
Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.
Workarounds
- Upgrade
@modelcontextprotocol/sdkto>=1.26.0(note: the SDK will throw on transport reuse, which will breakmcp-handler< 1.1.0 which effectively forces the upgrade) - Alternatively, manually create fresh
McpServerand transport instances per request in your handler code
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mcp-handler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T23:58:50Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "`mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` \u003c 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a `StreamableHTTPServerTransport` instance is reused across requests.\n\n**Note:** This is _not_ a vulnerability in `mcp-handler` itself. The root cause is in the peer dependency `@modelcontextprotocol/sdk`. \n\n### Impact\n\nA low-privileged attacker making concurrent requests to an `mcp-handler` endpoint can read another client\u0027s session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.\n\n**Root Cause:** [CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536) in `@modelcontextprotocol/sdk` \u003c 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.\n\n### Patches\n\nUpgrade to `mcp-handler@1.1.0`. This release raises the minimum peer dependency to `@modelcontextprotocol/sdk@\u003e=1.26.0`, which contains the fix for CVE-2026-25536. \n\n### Workarounds\n\n- Upgrade `@modelcontextprotocol/sdk` to `\u003e=1.26.0` (note: the SDK will throw on transport reuse, which will break `mcp-handler` \u003c 1.1.0 which effectively forces the upgrade)\n- Alternatively, manually create fresh `McpServer` and transport instances per request in your handler code",
"id": "GHSA-w2fm-25vw-vh7f",
"modified": "2026-04-01T23:58:50Z",
"published": "2026-04-01T23:58:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vercel/mcp-handler/security/advisories/GHSA-w2fm-25vw-vh7f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25536"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-345p-7cg4-v4c7"
},
{
"type": "PACKAGE",
"url": "https://github.com/vercel/mcp-handler"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "mcp-handler has a tool response leak across concurrent client sessions (\u0027Race Condition\u0027)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.