MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
影響: npm:@modelcontextprotocol/sdk >= 1.3.0, < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/server >= 2.0.0, < 2.3.0 → 2.3.0
In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are needed, unless you authenticate requests before they reach the SDK. Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for McpServer tools whose input…
| CVE | CVE-2026-111768 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 21. 오전 05:06, GitHub Advisory Database에서 "MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-111768.