high · 7.5 Patched

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

CVE-2026-111768 · GHSA-46jr-4wx8-v453 · published 20 Oct 2026

How serious is it

  • Severity: high, CVSS score 7.5 out of 10.
  • No exploit prediction (EPSS) score yet.
  • Not on the CISA list of exploited vulnerabilities.
  • No public exploit in Exploit-DB.

Is your app affected by CVE-2026-111768?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

  • @modelcontextprotocol/sdk (npm) >= 1.3.0, < 1.32.0
  • @modelcontextprotocol/server (npm) >= 2.0.0, < 2.3.0

How to check

  1. Run npm ls @modelcontextprotocol/sdk in your project to see the installed version, including copies pulled in by other packages.
  2. Run npm ls @modelcontextprotocol/server in your project to see the installed version, including copies pulled in by other packages.
  3. Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
  4. Or run npx shippable-dev scan localhost:3000 in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
  1. On >= 1.3.0, < 1.32.0: Upgrade @modelcontextprotocol/sdk to 1.32.0 or later, commit the lockfile and redeploy.
  2. On >= 2.0.0, < 2.3.0: Upgrade @modelcontextprotocol/server to 2.3.0 or later, commit the lockfile and redeploy.
  3. If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`. No credentials are needed, unless you authenticate requests before they reach the SDK. ### Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected. Affected versions: - `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0 - `@modelcontextprotocol/server` 2.0.0 through 2.2.0 ### Fix Upgrade to: - 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later - 2.x: `@modelcontextprotocol/server` 2.3.0 or later **Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes: 1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result. 2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit. If you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities