{"api_version":"v1","generated_at":"2026-10-02T10:30:00+00:00","product":{"cve_count":2,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-modelcontextprotocol-typescript-sdk-4afa4ed3eb55","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/typescript-sdk","name":"typescript-sdk","next_cursor":null,"observations":[{"affected":">= 1.10.0, < 1.26.0","affected_versions_present":true,"cve_id":"CVE-2026-25536","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25536","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-15T01:16:18.414Z","patch_url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7","primary_source":"","published":"2026-02-04T21:29:38.276Z"},{"affected":"< 1.24.0","affected_versions_present":true,"cve_id":"CVE-2025-66414","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-66414","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-12-02T18:46:02.374Z","patch_url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/09623e2aa5044f9e9da62c73d820a8250b9d97ed","primary_source":"","published":"2025-12-02T18:12:29.848Z"}],"source_generated_at":"2026-10-02T06:19:59.452Z","vendor":"modelcontextprotocol"}}