Whose response is this? The MCP server SDK that matched replies by id alone
Whose response is this? The MCP server SDK that matched replies by id alone A vector breakdown of CVE-2026-111770 / GHSA-jm63-cq47-j5jp ( @modelcontextprotocol/server 2.0.0 through 2.2.0, fixed in 2.3.0) No injection, no stolen token. Two people use the same MCP server over HTTP at the same time, and one of them gets the other's answer. That's the whole bug, and it came straight from the pattern…
The MCP server SDK is vulnerable to a race condition where two clients sharing a single HTTP connection can receive each other's responses. This occurs when the SDK uses JSON-RPC IDs alone to match replies to their respective requests. Since SDK clients generate IDs starting from 0, collisions are inevitable when multiple clients are involved.
The bug results from treating IDs as security identities and utilizing a stateless HTTP transport that can be shared across requests. To address this, developers should either create a new transport per request or per session, or use a factory function that generates a fresh server instance with each call. This ensures that each client's responses are properly isolated and not leaked to other clients.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
