HIGH 7.5 GitHub
CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
### Summary
In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.
No credentials are needed, unless you authenticate requests before they reach the SDK.
### Am I affected?
Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools
Affected Products
- npm/@modelcontextprotocol/sdk >= 1.3.0, < 1.32.0
- npm/@modelcontextprotocol/server >= 2.0.0, < 2.3.0
References
- https://github.com/advisories/GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2926
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2927
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-20 via GitHub. Affected: npm/@modelcontextprotocol/sdk >= 1.3.0, < 1.32.0, npm/@modelcontextprotocol/server >= 2.0.0, < 2.3.0.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.