SB20261109229 - Race condition in typescript-sdk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109229

SB20261109229 - Race condition in typescript-sdk

Published: November 9, 2026

Security Bulletin ID SB20261109229
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-25536)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to receive response data intended for other clients.

The vulnerability exists due to improper synchronization in the TypeScript SDK's StreamableHTTPServerTransport when a deployment reuses one transport instance for concurrent client requests with overlapping JSON-RPC message IDs. A low-privileged remote attacker can submit requests with matching message IDs while another client's requests are in flight, causing that client's responses to reach the attacker.


Remediation

Install update from vendor's website.

References