{"data":{"id":"769ae8f1-ed4a-47c9-abd2-a21127814a40","title":"CVE-2026-0621: Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service…","summary":"Anthropic's MCP TypeScript SDK, versions up to and including 1.25.1, contains a regular expression denial of service (ReDoS) flaw (CVE-2026-0621) in the UriTemplate class when it processes RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on crafted input, driving CPU use up. An attacker who supplies a malicious URI can make the Node.js process unresponsive.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0621","publishedAt":"2026-01-06T02:16:14.533Z","cveId":"CVE-2026-0621","cweIds":["CWE-1333"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["@modelcontextprotocol/sdk@>= 1.3.0, < 1.25.2 (fixed: 1.25.2)"],"affectedPackageNames":["@modelcontextprotocol/sdk"],"affectedPackageRefs":["npm:@modelcontextprotocol/sdk"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Anthropic MCP TypeScript SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Anthropic MCP TypeScript SDK ReDoS in UriTemplate array pattern matching","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00438,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-8r9q-7v3j-jr4g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:28.590Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-01-07T15:34:12.576Z","daysToFix":1,"fixCheckedAt":"2026-10-29T21:42:10.512Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@modelcontextprotocol/sdk","fixedVersion":"1.25.2","matchedVersion":"1.25.2","fixReleasedAt":"2026-01-07T15:34:12.576Z","daysToFix":1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:10.348Z"}]}}