TypeScript SDK for Model Context Protocol Vulnerability in HTTP Server from Project Vendor
CVE-2026-111768
What is CVE-2026-111768?
A significant vulnerability exists in the Model Context Protocol TypeScript SDK where the HTTP servers fail to enforce an upper limit on the number of array elements and object keys during validation. This can potentially lead to memory exhaustion as large array-element or object-key workloads within the permissible request size can overwhelm server resources. The default request size limit is 4 MiB, and this flaw does not require authentication unless the application itself mandates it prior to processing. Users are advised to configure both input element bounds and a proper request body size limit for enhanced protection. This issue has been resolved in the updated versions of the SDK: @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.
Affected Version(s)
sdk >= 1.3.0, < 1.32.0
server >= 2.0.0, < 2.3.0
typescript-sdk >= 1.3.0, < 1.32.0