MCP TypeScript SDK Advisory Batch: One Client's Responses Delivered to Another, Unbound Tasks, and Bearer Tokens for Other Services Accepted (CVE-2026-111770)

`@modelcontextprotocol/sdk` before 1.32.0 and `@modelcontextprotocol/server`, `client`, and `express` 2.x before the October 20, 2026 fixes

Five advisories were published on October 20. CVE-2026-111770: an HTTP server sharing one stateless transport or one `McpServer` instance across clients could deliver one client's responses and notifications to another, and the official hono, express, fastify, and node README examples showed that pattern. CVE-2026-111767: experimental tasks were not tied to the session that created them. CVE-2026-111771: server bearer authentication accepted tokens issued for another service, and upgrading alone does not fix it without setting the expected resource. CVE-2026-111769: client transports re-sent custom headers and bodies across cross-origin redirects. CVE-2026-111768: a single request could exhaust server memory

Messages were matched to connections by JSON-RPC id alone while SDK clients number requests from 0, so ids collide in normal use; auth and task state were not bound to an audience or session