Denial of Service Vulnerability in Anthropic's MCP TypeScript SDK
CVE-2026-0621

8.7HIGH

Key Information:

Vendor

Anthropic

Status
Mcp Typescript Sdk
Vendor
CVE Published:
5 January 2026

What is CVE-2026-0621?

The MCP TypeScript SDK by Anthropic is vulnerable to a regular expression denial of service (ReDoS) issue in the UriTemplate class. This vulnerability affects versions up to and including 1.25.1, where the construction of nested quantifiers in dynamically generated regular expressions can lead to catastrophic backtracking. When processed with specially crafted RFC 6570 exploded array patterns, this can cause excessive CPU usage and potentially freeze the Node.js process, leading to denial of service. It is crucial for users of this SDK to implement mitigations against attacks that exploit this flaw.

Affected Version(s)

MCP TypeScript SDK 0 <= 1.25.1

References

https://github.com/modelcontextprotocol/typescript-sdk/is...
issue-tracking
https://www.vulncheck.com/advisories/mcp-typescript-sdk-u...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Weblover
.