Skip to content

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

High severity GitHub Reviewed Published Mar 31, 2026 in vercel/mcp-handler

Package

npm mcp-handler (npm)

Affected versions

< 1.1.0

Patched versions

1.1.0

Description

mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.

Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.

Impact

A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.

Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.

Patches

Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.

Workarounds

  • Upgrade @modelcontextprotocol/sdk to >=1.26.0 (note: the SDK will throw on transport reuse, which will break mcp-handler < 1.1.0 which effectively forces the upgrade)
  • Alternatively, manually create fresh McpServer and transport instances per request in your handler code

References

@appsecrani appsecrani published to vercel/mcp-handler Mar 31, 2026
Published to the GitHub Advisory Database Apr 1, 2026
Reviewed Apr 1, 2026

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS score

Weaknesses

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. Learn more on MITRE.

Dependency on Vulnerable Third-Party Component

The product has a dependency on a third-party component that contains one or more known vulnerabilities. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-w2fm-25vw-vh7f

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.