MCP server SDK flaw leaked one client's replies to another via JSON-RPC id

@modelcontextprotocol/server 2.0.0–2.2.0 over HTTP could deliver one client's responses and notifications to another because messages were matched to a connection by JSON-RPC id alone, and SDK clients number requests from 0. The race condition CVE-2026-111770 (CVSS 7.7) is fixed in 2.3.0, which now rejects a second connect() on a shared transport.

• Versions 2.0.0 through 2.2.0 affected, fixed in 2.3.0
• CWE-362 race condition rated High, CVSS 3.1 score 7.7
• Root cause was README examples creating one server and transport at startup
• 2.3.0 rejects a second connect() with ALREADY_CONNECTED