7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w2fm-25vw-vh7f

GHSA-w2fm-25vw-vh7f: mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.

Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.

Impact

A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.

Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.

Patches

Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.

Workarounds

Upgrade @modelcontextprotocol/sdk to >=1.26.0 (note: the SDK will throw on transport reuse, which will break mcp-handler < 1.1.0 which effectively forces the upgrade)
Alternatively, manually create fresh McpServer and transport instances per request in your handler code

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w2fm-25vw-vh7f

GHSA-w2fm-25vw-vh7f:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-handler	npm	< 1.1.0	1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a race condition in mcp-handler caused by its usage of a vulnerable peer dependency, @modelcontextprotocol/sdk. The core issue lies in the reuse of a StreamableHTTPServerTransport instance across concurrent client requests, which the underlying SDK did not handle safely, leading to state sharing. The provided patch in commit 7ac97dc432cb24c2437cfc36e1f5e41547f97486 directly addresses this. The changes in src/handler/mcp-api-handler.ts within the initializeMcpApiHandler function show the removal of the shared statelessTransport. The corrected code now creates a new WebStandardStreamableHTTPServerTransport and a new McpServer instance for each individual POST request. This ensures that each client session is isolated, thereby mitigating the race condition and preventing the information leak. The function initializeMcpApiHandler is identified as the vulnerable function because it was responsible for establishing the flawed pattern of reusing the transport, which is the root cause of the vulnerability within the mcp-handler package.

Vulnerable functions

initializeMcpApiHandler

src/handler/mcp-api-handler.ts

The `initializeMcpApiHandler` function created a single instance of `StreamableHTTPServerTransport` and reused it across all incoming requests. Due to a race condition vulnerability in the underlying `@modelcontextprotocol/sdk` library (prior to version 1.26.0), this reuse of the transport object allowed server-side state, including authentication context and tool execution results, to be shared between concurrent client sessions. The vulnerable operation was the call to `statelessTransport.handleRequest` on this shared transport instance within the request handler logic returned by `initializeMcpApiHandler`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.