Race Condition Affecting @modelcontextprotocol/server package, versions >=2.0.0 <2.3.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-MODELCONTEXTPROTOCOLSERVER-21691379
- published24 Oct 2026
- disclosed20 Oct 2026
- creditDavid Carliez, legitu1337
Introduced: 20 Oct 2026
NewCVE-2026-111770 (opens in a new tab)How to fix?
Upgrade @modelcontextprotocol/server to version 2.3.0 or higher.
Overview
@modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package
Affected versions of this package are vulnerable to Race Condition via transport instance reuse in streamableHttp.ts and createMcpHandler.ts, where a stateless transport or server instance can be connected to multiple concurrent requests. An attacker can send concurrent or sequential HTTP requests that share the same transport instance, causing cross-request data leakage (confidentiality impact), partial state corruption (integrity impact), or a crash of the affected handler (availability impact).