fix: create fresh transport+server per stateless request (CVE-2026-25536)#147
Open
georeith wants to merge 1 commit intovercel:mainfrom
Open
fix: create fresh transport+server per stateless request (CVE-2026-25536)#147georeith wants to merge 1 commit intovercel:mainfrom
georeith wants to merge 1 commit intovercel:mainfrom
Conversation
georeith
force-pushed
the
fix/stateless-transport-reuse
branch
from
230ac5f to
c7cf335
Compare
) SDK >=1.26.0 prevents reuse of a stateless StreamableHTTPServerTransport. Move transport and McpServer instantiation into the POST handler so each request gets its own instances. Also widen @modelcontextprotocol/sdk peerDep to >=1.25.2 and add a regression test that sends two independent clients sequentially. Made-with: Cursor
georeith
force-pushed
the
fix/stateless-transport-reuse
branch
from
c7cf335 to
38f71c9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
StreamableHTTPServerTransportandMcpServerper POST request in stateless mode, instead of reusing a singleton pair across all requests.@modelcontextprotocol/sdkpeer dependency from the pinned1.25.2to>=1.25.2so consumers can use patched SDK versions.Problem
@modelcontextprotocol/sdk>=1.26.0 added runtime guards to fix CVE-2026-25536, a High severity cross-client data leak where JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection.The guard enforces that a stateless
StreamableHTTPServerTransportcannot be reused across requests:mcp-handlercreates a single transport and server at module init time and reuses them for every POST request, which triggers this guard on SDK >=1.26.0 and returns a 500 to all requests after the first.Fix
Moves the
StreamableHTTPServerTransportandMcpServercreation from module-level singletons into the POST handler, so a fresh instance of each is created per request. This matches the workaround recommended in the CVE advisory.Test plan
should read server capabilitiesis a pre-existing issue onmaindue to new SDK fields in the tool schema)yarn dedupeunified the SDK to 1.27.0