typescript-sdk

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationCVE-2026-111768modelcontextprotocol · CVSS 7.5 · 0.6% likely

   CWE-770

2. DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostCVE-2025-66414modelcontextprotocol · CVSS 7.6 · 0.5% likely

   CWE-1188

3. Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceCVE-2026-111771modelcontextprotocol · CVSS 6.8 · 0.5% likely

   CWE-863

4. Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesCVE-2026-111769modelcontextprotocol · CVSS 6.5 · 0.4% likely

   CWE-200

5. Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherCVE-2026-111770modelcontextprotocol · CVSS 7.7 · 0.4% likely

   CWE-362

6. MCP TypeScript SDK: Experimental tasks were not tied to the session that created themCVE-2026-111767modelcontextprotocol · CVSS 8.6 · 0.3% likely

   CWE-639

7. @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25536modelcontextprotocol · CVSS 7.1 · 0.3% likely

   CWE-362

8. MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverCVE-2026-104850modelcontextprotocol · CVSS 7.5 · 0.3% likely

   CWE-345

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.