MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.