Evidence · DiggingBeagle record
MCP TypeScript SDK GHSA-jm63-cq47-j5jp: shared transport leaks HTTP client messages
October 15 maintainer advisory confirming misrouting of responses and notifications through shared HTTP server or transport instances.
- Source role
- primary disclosure
Evidence record
October 15 maintainer advisory confirming misrouting of responses and notifications through shared HTTP server or transport instances.
Claim-level citations (2)
- supportsShared MCP TypeScript HTTP server instances leak messages across clients: Version 2.3.0 prevents reuse and requires applications to create new per-request or per-session server and transport instances, not simply update the package.
Fix; affected versions; patched versions
- supportsShared MCP TypeScript HTTP server instances leak messages across clients: Maintainers report that shared MCP server or transport instances could deliver another HTTP client's responses or notifications when JSON-RPC request identifiers collided.
Summary; Am I affected?