Vercel deploy fails with @modelcontextprotocol/sdk 1.26.0

[adam-messinger]

Description

Upgrading @modelcontextprotocol/sdk from 1.25.2 to 1.26.0 causes Vercel deployments to fail. The build succeeds locally with next build but fails on Vercel's serverless build pipeline.

Reproduction

1. Start with a working Next.js + mcp-handler project deployed on Vercel
2. Run npm install @modelcontextprotocol/sdk@1.26.0
3. Push — Vercel deployment fails

Reverting to 1.25.2 fixes the issue immediately.

Environment

• mcp-handler: 1.0.7
• next: 16.1.6
• @modelcontextprotocol/sdk: 1.26.0 (fails) / 1.25.2 (works)
• Node: 22.x
• Vercel serverless functions

Likely cause

SDK 1.26.0 introduces new transitive dependencies (express, express-rate-limit, ip-address) for its built-in HTTP transport. These likely conflict with Vercel's serverless bundling — either due to size limits, native module issues, or incompatible imports.

The local next build completes successfully, so this appears to be specific to Vercel's deployment pipeline.

Workaround

Pin @modelcontextprotocol/sdk to ^1.25.2.

Notes

• SDK 1.26.0 contains a security fix (GHSA-345p-7cg4-v4c7: shared server/transport instances could leak cross-client response data), so staying on 1.25.2 indefinitely is not ideal.
• The mcp-handler npm page currently recommends 1.25.2.

[brownoxford]

Note that v1.25.3 also contains a security issue now.