MCP TypeScript SDK
CVE-2026-0621
HIGH
GHSA-8r9q-7v3j-jr4g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MCP endpoint over network
-
DeliveryCraft malicious URI for exploded-array template
-
ExploitSubmit URI to UriTemplate matcher
-
ExecutionTrigger catastrophic regex backtracking
-
PersistBlock Node.js event loop
-
ImpactService unresponsive (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application use the SDK's UriTemplate class to match untrusted URIs against an RFC 6570 template containing an exploded array expansion (asterisk-modified variable, e.g. {/path*} or {?query*}); that specific feature is the trigger, so servers that never expose such templates to attacker-controlled input are not reachable. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed once that code path is exposed, and it works against default SDK behavior in the affected versions. The practical limiting factor is reachability: the attacker must be able to route a crafted URI into the vulnerable matching call, which depends on whether the MCP server registers exploded-array resource templates and accepts external URI input. |
| Impact | The signals are internally consistent but point to a moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and VC/VI at N) correctly models a pure availability impact reachable by an unauthenticated remote actor at low complexity, producing the 8.7 High base score - a number driven entirely by availability, not by any data compromise. Against that, EPSS is only 0.02% (6th percentile) and there is no CISA KEV entry, indicating no observed active exploitation; the high score reflects ease of triggering a hang, not likelihood of mass exploitation. Public exploit code (GitHub issue #965) lowers the reproduction barrier, but a ReDoS that causes a recoverable CPU stall is far less consequential than an RCE at the same score. Net: patch it on exposed or multi-tenant MCP servers, but treat it as a high-CVSS availability issue rather than an emergency. One caveat to verify: reachability of the vulnerable UriTemplate path from untrusted input depends on whether a given MCP server registers exploded-array resource templates - confirm against your deployment. |
| Exploit ScenarioDerived | An attacker with network access to an MCP server that matches user-supplied URIs against an exploded-array URI template sends a single crafted URI engineered to maximize regex backtracking. The Node.js event loop blocks on the match and stops servicing all other requests, taking the server offline until the process is killed or restarted. Because low-complexity public exploit code exists (GitHub issue #965) and no authentication is required, reproduction is straightforward against any reachable vulnerable instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 14, 2026
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
Earlier versions of this analysis (2)
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK (versions ≤ 1.25.1) allows remote attackers to hang the Node.js event loop by sending a crafted URI that triggers catastrophic regex backtracking in the UriTemplate matcher. The flaw lives in the dynamically built regular expression used to match RFC 6570 exploded array patterns, whose nested quantifiers make a single malicious input consume unbounded CPU. Publicly available exploit code exists (GitHub issue #965); EPSS is low (0.02%, 6th percentile) and it is not on the CISA KEV list, so no public exploit is identified as actively exploited at time of analysis.
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. [CVSS 7.5 HIGH]
RemediationAI
Patch available per vendor advisory - upgrade the @modelcontextprotocol TypeScript SDK to a release later than 1.25.1 that contains the UriTemplate fix; the exact patched version is not stated in the provided data, so pin to the current fixed release referenced in upstream GitHub issue https://github.com/modelcontextprotocol/typescript-sdk/issues/965 and confirm it against the VulnCheck advisory https://www.vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos before rollout. If you cannot upgrade immediately, avoid exposing resource templates that use exploded array expansions (patterns like {/var*} or {?var*}) to untrusted callers, and validate or length-cap incoming URIs before they reach UriTemplate matching. As a stronger control, run URI matching in a worker thread or under a per-operation timeout so a stalled match cannot freeze the main event loop - the trade-off is added latency and code complexity. Placing authentication or network ACLs in front of the MCP endpoint reduces exposure at the cost of blocking some legitimate integrations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the UriTemplate class in the MCP TypeScript SDK, which implements RFC 6570 URI Template matching on Node.js. When handling 'exploded' array expansions (variables with the asterisk modifier, e.g. {/list*} or {?keys*}), the SDK compiles a regular expression at runtime to parse candidate URIs, and that generated expression embeds nested quantifiers - the classic precondition for CWE-1333 (Inefficient Regular Expression Complexity / ReDoS). On adversarial input the regex engine explores an exponential number of backtracking paths, so a short input yields disproportionate CPU work. Because Node.js runs regex matching synchronously on its single main thread, this stalls the entire event loop rather than a single request. The CPE cpe:2.3:a:lfprojects:mcp_typescript_sdk identifies the package (attributed to the LF Projects / Linux Foundation umbrella stewarding MCP), and the fix is tracked in upstream GitHub issue #965.
Know when Mcp Typescript Sdk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity trigger with no user interaction; impact is a pure availability hang of the Node process, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.
Blast Radius
ecosystem impact- 2 npm packages depend on @modelcontextprotocol/sdk (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.3.0.
Executive ViewAI
Anthropic's Model Context Protocol (MCP) TypeScript SDK versions 1.25.1 and earlier contain a denial-of-service vulnerability that could disable dependent applications. Public exploit code exists; organizations should prioritize patching to prevent service disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB