Answer in brief
CVE-2026-111771 records a Medium severity (CVSS 6.8) vulnerability in MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service. The current sources do not mark it as known exploited. The current feed maps @modelcontextprotocol/express (npm), @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm), @modelcontextprotocol/server-legacy (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @modelcontextprotocol/express (npm), @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm), @modelcontextprotocol/server-legacy (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @modelcontextprotocol/expressnpm | >=2.0.0,<2.0.2 | 2.0.2 |
| @modelcontextprotocol/sdknpm | >=1.6.0,<1.32.0 | 1.32.0 |
| @modelcontextprotocol/servernpm | >=2.0.0,<2.3.0 | 2.3.0 |
| @modelcontextprotocol/server-legacynpm | >=2.0.0,<2.3.1 | 2.3.1 |
Published upstream
Oct 20, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself. Affected versions: - `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0 - `@modelcontextprotocol/server` 2.0.0 through 2.2.0 - `@modelcontextprotocol/express` 2.0.0 through 2.0.1 - `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0 ### Fix Upgrade to: - 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later - 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it - `@modelcontextprotocol/server-legacy` 2.3.1 or later **Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together: 1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`. 2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`. A token for another service then gets `401`. With only the first change, every request gets `401`. If you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.
Quoted source text, attributed separately from HOL analysis.