HighVulnerability

GHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-111768GHSA-46jr-4wx8-v453
Published: October 20, 2026
Record updated: October 20, 2026

Affected: @modelcontextprotocol/server >= 2.0.0, < 2.3.0, fixed in 2.3.0
@modelcontextprotocol/sdk >= 1.3.0, < 1.32.0, fixed in 1.32.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.

Summary

The MCP TypeScript SDK (`@modelcontextprotocol/sdk` 1.3.0 through 1.31.0, and `@modelcontextprotocol/server` 2.0.0 through 2.2.0) placed no limit on the number of array elements and object keys it validated per request. A single HTTP request within the default 4 MiB size limit can exhaust server memory and abort the process with `JavaScript heap out of memory`. No credentials are needed unless requests are authenticated before reaching the SDK, and stdio-only servers are not affected.

Mitigation

Upgrade to `@modelcontextprotocol/sdk` 1.32.0 or later, or `@modelcontextprotocol/server` 2.3.0 or later, then set the new `maxToolInputElements` option on `McpServer` (off by default), for example `new McpServer(info, { maxToolInputElements: 10_000 })`. Also lower the request size limit with `maxRequestBodySize` on the transport or `createMcpHandler()`, or the body parser's limit if the body is parsed manually. If upgrading is not possible yet, set `maxRequestBodySize`, which requires `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0, or use a reverse proxy.

Details

Scores and exploitation

Patch available: Yes
EPSS: Not scored. FIRST had not published an EPSS score for this CVE when it was last checked on October 20, 2026.
Disclosure date: October 20, 2026

Affected

Packages: @modelcontextprotocol/server@>= 2.0.0, < 2.3.0 (fixed: 2.3.0)
@modelcontextprotocol/sdk@>= 1.3.0, < 1.32.0 (fixed: 1.32.0)
Vendors: Anthropic

Classification

Attack type: Denial of service
Attack sophistication: Trivial
AI component targeted: API
Impact: Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-46jr-4wx8-v453

First tracked: October 20, 2026 at 08:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

@modelcontextprotocol/sdknpmLLM dependency since 2024-11-11 · 18 tracked dependents
@modelcontextprotocol/servernpmNo LLM dependency detected · 3 tracked dependents

Topics

Model Context Protocol

Summary

Mitigation

Affected packages in the Exposure Registry

Topics

Related items