The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol.
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also r
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Modelcontextprotocol, @Modelcontextprotocol
- Product
- typescript-sdk, sdk, client
- CVSS v3.1
- 6.5 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Fix
- available
- Weakness
- CWE-200
- Exposure class
- Developer platform, AI infrastructure
- NVD status
- Received
Why it ranks 19 (Routine)
- CVSS v3.1 6.5 medium
- Product class: developer platform, AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-111769 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.