GHSA-w2fm-25vw-vh7f mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

Q: Which versions are affected by GHSA-w2fm-25vw-vh7f?

2 open source packages ship an affected version, including mcp-handler.

Q: Is GHSA-w2fm-25vw-vh7f being exploited?

There is no known exploitation of GHSA-w2fm-25vw-vh7f in the wild and no public exploit code.

Q: How do I fix GHSA-w2fm-25vw-vh7f?

Upgrade mcp-handler to 1.1.0 or later.

Not scored Published 1 Apr 2026

A race condition in the MCP handler library allows low-privileged attackers to read other clients' session data and authentication context via concurrent requests.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-w2fm-25vw-vh7f?

GHSA-w2fm-25vw-vh7f is a vulnerability in mcp-handler, published on 1 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.

Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.

Impact

A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.

Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.

Patches

Upgrade to [email protected]. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.

Workarounds

Upgrade @modelcontextprotocol/sdk to >=1.26.0 (note: the SDK will throw on transport reuse, which will break mcp-handler < 1.1.0 which effectively forces the upgrade)
Alternatively, manually create fresh McpServer and transport instances per request in your handler code

Which versions are affected by GHSA-w2fm-25vw-vh7f?