Memory exhaustion in Model Context Protocol TypeScript SDK
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
The Model Context Protocol TypeScript SDK from 1.3.0 before 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 before 2.3.0 in @modelcontextprotocol/server does not limit array elements and object keys validated in HTTP requests (CWE-770). A remote attacker can send one request within the default 4 MiB limit that exhausts memory and terminates the process. No credentials are required unless the application authenticates before SDK processing.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | typescript-sdk | 1.3.0 to before 1.32.0 | 1.32.0 | Patch available | CNA |
| MLflow | server | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | CNA |
| MLflow | sdk | 1.3.0 to before 1.32.0 | 1.32.0 | Patch available | CNA |
| — | @modelcontextprotocol/sdk (npm) | 1.3.0 to before 1.32.0 | 1.32.0 | Patch available | GHSA-46jr-4wx8-v453 |
| — | @modelcontextprotocol/server (npm) | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | GHSA-46jr-4wx8-v453 |
- typescript-sdk VendorMLflow Affected 1.3.0 to before 1.32.0 Fixed in 1.32.0 Patch available CNA
- server VendorMLflow Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
- sdk VendorMLflow Affected 1.3.0 to before 1.32.0 Fixed in 1.32.0 Patch available CNA
- @modelcontextprotocol/sdk (npm) Vendor— Affected 1.3.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-46jr-4wx8-v453
- @modelcontextprotocol/server (npm) Vendor— Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-46jr-4wx8-v453
Remediation
Upgrade @modelcontextprotocol/sdk to 1.32.0 or @modelcontextprotocol/server to 2.3.0. Upgrading alone does not enable the new validation bound, so also configure a tool-input element bound and an appropriate request body size limit.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA typescript-sdk (modelcontextprotocol) Fixed in 1.32.0
- Fix · CNA server (@modelcontextprotocol) Fixed in 2.3.0
- Fix · CNA sdk (@modelcontextprotocol) Fixed in 1.32.0
- Fix · GHSA-46jr-4wx8-v453 @modelcontextprotocol/sdk (npm) Fixed in 1.32.0 Advisory →
- Fix · GHSA-46jr-4wx8-v453 @modelcontextprotocol/server (npm) Fixed in 2.3.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111768
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 8
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2926
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2927
- https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37
- https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/[email protected]
- https://github.com/modelcontextprotocol/typescript-sdk
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-111768 · CVE Program
- CVE-2026-111768 · NVD
- FIRST EPSS
- CVE-2026-111768 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences