UpHeron
All vulnerabilities

npm

CVE-2026-111768

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Severity
High 7.5
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.32.0, 2.3.0
Also known as
GHSA-46jr-4wx8-v453
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
@modelcontextprotocol/sdknpm · osv:npm:@modelcontextprotocol/sdk
  • From 1.3.0 before 1.32.0
@modelcontextprotocol/servernpm · osv:npm:@modelcontextprotocol/server
  • From 2.0.0 before 2.3.0

References