{"data":{"id":"3307bead-53ee-4b3c-bceb-5a97d6160ebe","title":"GHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length","summary":"Affected versions of the MCP TypeScript SDK put no limit on the size of HTTP POST bodies or on the number of messages in a JSON-RPC batch, so large requests can exhaust server memory and a long batch can block other clients. Exploitation needs no credentials unless the application authenticates requests before they reach the SDK, and stdio-only servers are not affected.","solution":"Upgrade @modelcontextprotocol/sdk to 1.30.1 or later for 1.x, and to @modelcontextprotocol/server 2.1.0, @modelcontextprotocol/node 2.1.0 and @modelcontextprotocol/hono 2.0.1 or later for 2.x, upgrading every installed package. Bodies over 4 MiB now get 413 and batches over 100 messages get 400; raise the maxRequestBodySize option if clients send larger bodies. If upgrading is not possible yet, cap request body size in a reverse proxy.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-f897-62hf-6gxq","publishedAt":"2026-10-27T19:02:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["@modelcontextprotocol/hono@>= 2.0.0, < 2.0.1 (fixed: 2.0.1)","@modelcontextprotocol/node@>= 2.0.0, < 2.1.0 (fixed: 2.1.0)","@modelcontextprotocol/server@>= 2.0.0, < 2.1.0 (fixed: 2.1.0)","@modelcontextprotocol/sdk@>= 1.10.0, < 1.30.1 (fixed: 1.30.1)"],"affectedPackageNames":["@modelcontextprotocol/hono","@modelcontextprotocol/node","@modelcontextprotocol/server","@modelcontextprotocol/sdk"],"affectedPackageRefs":["npm:@modelcontextprotocol/hono","npm:@modelcontextprotocol/node","npm:@modelcontextprotocol/server","npm:@modelcontextprotocol/sdk"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["MCP TypeScript SDK","@modelcontextprotocol/sdk","@modelcontextprotocol/server","@modelcontextprotocol/node","@modelcontextprotocol/hono"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-f897-62hf-6gxq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-27T19:02:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}