CVE-2026-111768 · GHSA-46jr-4wx8-v453
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
- Risk score
- 55/100
- CVSS
- 7.5 v3.1
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are needed, unless you authenticate req…
- Affected
- @modelcontextprotocol/sdk (npm) >= 1.3.0, < 1.32.0; @modelcontextprotocol/server (npm) >= 2.0.0, < 2.3.0
- Fix
- Upgrade @modelcontextprotocol/sdk to 1.32.0; @modelcontextprotocol/server to 2.3.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@modelcontextprotocol/sdk: Amber, patch this week. The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, allowing clients to list, read, and cancel each other's tasks. An attacker could exploit this vulnerability to gain control over other clients' tasks.
The flaws
- CVE-2026-111768: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (CVSS 7.5)
- CVE-2026-111767: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (CVSS 8.6 · EPSS 0%)
- CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (CVSS 7.5 · EPSS 0%)
- CVE-2026-111771: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVSS 6.8)
The fix
Upgrade @modelcontextprotocol/sdk: 1.32.0 · 1.31.0 · 2.2.0 or later on your release line
Who is exposed: {'products': ['MCP TypeScript SDK'], 'packages': [{'ecosystem': 'npm', 'name': '@modelcontextprotocol/sdk', 'vulnerable': '>= 1.24.0, < 1.32.0', 'patched': '1.32.0'}], 'versions': ['1.24.0 to 1.32.0 (exclusive)', '1.32.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-770). 202 other warnings in 30 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @modelcontextprotocol/sdk | npm | >= 1.3.0, < 1.32.0 | 1.32.0 |
| @modelcontextprotocol/server | npm | >= 2.0.0, < 2.3.0 | 2.3.0 |
References
- https://github.com/advisories/GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2926
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2927
- https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37
- https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f
- https://github.com/advisories/GHSA-46jr-4wx8-v453
Original description
### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`. No credentials are needed, unless you authenticate requests before they reach the SDK. ### Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected. Affected versions: - `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0 - `@modelcontextprotocol/server` 2.0.0 through 2.2.0 ### Fix Upgrade to: - 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later - 2.x: `@modelcontextprotocol/server` 2.3.0 or later **Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes: 1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result. 2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit. If you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.
Last activity 20 Oct 2026. Patch Forecast updates every hour.