Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.

Etkilenen sürümler3 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…pt-sdk/security/advisories/GHSA-46jr-4wx8-v453 Diğer
• github.com/modelcontextprotocol/typescript-sdk/pull/2926 Diğer
• github.com/modelcontextprotocol/typescript-sdk/pull/2927 Diğer
• github.com/…ommit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37 Diğer
• github.com/…ommit/fd26801b3b387742fe24a90ed4b275dd6072209f Diğer
• github.com/…extprotocol/typescript-sdk/releases/tag/1.32.0 Diğer
• github.com/…eleases/tag/@modelcontextprotocol/server@2.3.0 Diğer

Kayıt geçmişi

1. 6 Kas 2026 00:22Yayımlandı

İlgili açıklar

• 7,7 CVE-2026-111770Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
• 6,5 CVE-2026-111769Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
• 6,8 CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
• 8,6 CVE-2026-111767MCP TypeScript SDK'da deneysel görevlerin oluşturuldukları oturuma bağlanmaması sorunu
• 8,2 CVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
• 6,3 CVE-2026-112899Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit