CLSA-2026-1793887996: TuxCare security update for @modelcontextprotocol/sdk (3 CVEs)
Published Nov 5, 2026
·Updated
TuxCare rebuilt @modelcontextprotocol/sdk to address 3 CVEs. Fixed in 1.17.3-tuxcare.4.
Affected Software
1 affected componentFixes available
tuxcare/@modelcontextprotocol/sdk>=1.17.3-tuxcare.0<1.17.3-tuxcare.4
1.17.3-tuxcare.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tuxcare/@modelcontextprotocol/sdkto a version that resolves this vulnerability.Fixed in 1.17.3-tuxcare.4 - Upgrade
Upgrade
@modelcontextprotocol/sdkto a version that resolves this vulnerability.Fixed in 1.17.3-tuxcare.4
Event History
Nov 5, 2026
Advisory Published
via OSV·03:13 PM
Data Sourced
via OSV·03:13 PM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
Which package build includes the fixes?
The 3 CVEs are addressed in the TuxCare rebuild @modelcontextprotocol/sdk version 1.17.3-tuxcare.4.
2
How can I determine whether my deployment needs this update?
Check whether your environment uses the TuxCare @modelcontextprotocol/sdk package and compare its installed version with 1.17.3-tuxcare.4. The provided data does not identify the individual CVEs, affected prior versions, or mitigations for unpatched installations.