CVE-2026-111768: MCP TypeScript SDK Memory Exhaustion Vulnerability
Summary
CVE-2026-111768: In affected versions, servers put no limit on how many array elements and object keys they validated in one request. Affects @modelcontextprotocol/sdk versions >= 1.3.0, < 1.32.0. Fixed in 1.32.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The MCP TypeScript SDK is a software development kit that facilitates the integration of Model Context Protocol (MCP) into applications. It allows developers to build tools that interact with the MCP server, enabling efficient data handling and processing. However, certain versions of this SDK are vulnerable to a memory exhaustion issue due to improper validation of input data, which can lead to server crashes.
Vulnerability Detail
In affected versions of the MCP TypeScript SDK, there is no limit on the number of array elements and object keys validated in a single HTTP request. This can lead to a situation where a single request, even within the default size limit of 4 MiB, can exhaust the server's memory. The server may abort the process with a 'JavaScript heap out of memory' error. This vulnerability primarily affects servers that are exposed to untrusted clients, particularly those using the McpServer tools that handle arrays or records.
How To Fix
Minimum fixed version
1.32.0
This is the first release that contains the fix.
npm install @modelcontextprotocol/sdk@1.32.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can implement a workaround by lowering the request size limit using 'maxRequestBodySize'. This option requires at least version 1.30.1 of the SDK or 2.1.0 of the server. If you are using a reverse proxy, ensure it is configured to limit request sizes appropriately.
Conclusion
The MCP TypeScript SDK has a significant vulnerability that can lead to memory exhaustion on the server. It is crucial for users of affected versions to upgrade to the patched versions and configure the server settings appropriately to mitigate this risk. Monitoring tools like Vulert can help in identifying vulnerabilities in real-time.
See every vulnerability recorded for @modelcontextprotocol/sdk →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Affected versions of the MCP TypeScript SDK are from 1.3.0 to 1.31.0.
If upgrading is not possible, implement a workaround by lowering the request size limit using 'maxRequestBodySize'.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for @modelcontextprotocol/sdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
