Our MCP server is built on the official TypeScript SDK and the October 2026 advisories just reached NVD (shared transports leaking between clients, tokens for other services accepted, memory exhaustion). Which version fixes them, and is bumping the package enough?

What should I check, step by step?

1. Run npm ls @modelcontextprotocol/sdk @modelcontextprotocol/server @modelcontextprotocol/express @modelcontextprotocol/node @modelcontextprotocol/hono @modelcontextprotocol/server-legacy and write down every version you actually ship, including ones pulled in by other packages.

2. Upgrade to sdk 1.32.0 or later (1.x), or server 2.3.0 or later with express 2.0.2, node 2.1.0 and hono 2.0.1 or later for whichever of those you have installed (2.x). server-legacy needs 2.3.1 or later for the audience fix.
3. Search your code for a transport or McpServer created once at module level and reused across HTTP requests. Replace it with createMcpHandler() and a factory that builds a new McpServer on every call, a new server and transport inside the request handler, or one server and transport per session with sessionIdGenerator set.
4. Turn on the audience check in two places at once: pass expectedResource (the URL your authorization server puts in tokens for your server) to requireBearerAuth(), and return the token's audience from verifyAccessToken() as AuthInfo.resource. With only the first change, every request gets 401.
5. If you can't upgrade yet, reject any token whose aud doesn't include your server inside verifyAccessToken(). The advisory says that closes the audience issue on every version.
6. Set maxToolInputElements just above the largest input your tools need, for example new McpServer(info, { maxToolInputElements: 10_000 }). It counts array elements and object keys in a call's arguments; a call over the limit gets an isError: true result.
7. Lower maxRequestBodySize to what your tools need, on the transport or createMcpHandler(). If you parse the body yourself with express.json() or Fastify, set that parser's limit too, and remember a body parser doesn't limit JSON-RPC batch length.
8. Add a test that sends two clients' requests with the same JSON-RPC id at the same time and checks each gets only its own response, a test that a token minted for another service gets 401, and a test that an oversized array argument is refused.

What do the October 2026 MCP TypeScript SDK server advisories fix, and which fixes are off by default?

GHSA-jm63-cq47-j5jp (CVE-2026-111770, high, published October 15, 2026) affects @modelcontextprotocol/server 2.0.0 through 2.2.0. An HTTP server could deliver one client's responses and notifications to another when clients shared one stateless transport or one McpServer or Server instance, because messages were matched to a connection by JSON-RPC id alone and SDK clients number requests from 0, so ids collide in normal use. The advisory notes that the README examples for the hono, express, fastify and node packages showed that pattern until this release. Not affected: createMcpHandler() with a factory that builds a new server per call, stdio servers, and @modelcontextprotocol/sdk 1.26.0 and later.

• GHSA-rvq5-wwqv-78pq (CVE-2026-111771, moderate, published October 5, 2026): the SDK's server-side bearer authentication had no way to check a token's audience, so where one authorization server issues tokens for several services, a valid token for another service was also accepted. You're affected if you use requireBearerAuth() or verifyBearerToken(), your authorization server also issues tokens for other services, and your verifyAccessToken() doesn't check aud itself. Affected: sdk 1.6.0 through 1.31.0, server 2.0.0 through 2.2.0, express 2.0.0 through 2.0.1 and server-legacy 2.0.0 through 2.3.0.
• GHSA-46jr-4wx8-v453 (CVE-2026-111768, high, published October 15, 2026): servers put no limit on how many array elements and object keys they validated in one request, so a single request inside the default 4 MiB limit could exhaust memory and abort the process with JavaScript heap out of memory, with no credentials needed unless you authenticate before the SDK. The risk is highest for McpServer tools whose input contains an array or a record. Affected: sdk 1.3.0 through 1.31.0 and server 2.0.0 through 2.2.0. If you can't upgrade, set maxRequestBodySize, which needs sdk 1.30.1 or server 2.1.0; below that, use a reverse proxy.
• GHSA-f897-62hf-6gxq (high, published October 15, 2026) is the one that works on upgrade: HTTP server transports had no limit on POST body size or JSON-RPC batch length, and one long batch could block a server from serving anyone else. sdk 1.30.1 and server 2.1.0, node 2.1.0 and hono 2.0.1 add the 4 MiB and 100-message limits by default; raise maxRequestBodySize only if your clients really send larger bodies.

Why does an MCP server fail with ALREADY_CONNECTED after upgrading the TypeScript SDK?

After the shared-transport fix, a second connect() on the same server rejects with ALREADY_CONNECTED and a stateless transport rejects its second request. That's deliberate: the advisory says the SDK now refuses to be shared, so an affected app fails requests after upgrading instead of silently crossing clients' data.

• The same code change fixes affected versions even before you upgrade, so it's worth doing first: build per request (simplest for stateless servers), use createMcpHandler() with a factory, or keep one server and transport per session. If you're also moving to the 2026-07-28 spec, which removes protocol-level sessions and makes every request self-describing, per-request construction is the natural fit.

How do you test that the MCP SDK audience check and input limits are actually enabled?

A green dependency scan only proves the version. For the audience fix, send a token issued by your authorization server for a different service and expect 401; if you get 200, expectedResource or AuthInfo.resource is missing. For the input bound, call a tool with an array argument larger than maxToolInputElements and expect an isError result, not a crash or a slow response.

• For the shared transport, run two clients against one deployment at the same time, both starting at request id 0, and check neither ever sees the other's results. Keep those three tests in CI so a later refactor that reintroduces a module-level server, or drops the options, fails the build instead of shipping.