MCP TypeScript SDK
CVE-2026-0621
HIGH
GHSA-8r9q-7v3j-jr4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity trigger with no user interaction; impact is a pure availability hang of the Node process, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8Blast Radius
ecosystem impact- 2 npm packages depend on @modelcontextprotocol/sdk (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.3.0.
DescriptionCVE.org
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.
AnalysisAI
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
Technical ContextAI
The affected component is the UriTemplate class in the MCP TypeScript SDK, which implements RFC 6570 URI Template matching on Node.js. When handling 'exploded' array expansions (variables with the asterisk modifier, e.g. {/list*} or {?keys*}), the SDK compiles a regular expression at runtime to parse candidate URIs, and that generated expression embeds nested quantifiers - the classic precondition for CWE-1333 (Inefficient Regular Expression Complexity / ReDoS). On adversarial input the regex engine explores an exponential number of backtracking paths, so a short input yields disproportionate CPU work. Because Node.js runs regex matching synchronously on its single main thread, this stalls the entire event loop rather than a single request. The CPE cpe:2.3:a:lfprojects:mcp_typescript_sdk identifies the package (attributed to the LF Projects / Linux Foundation umbrella stewarding MCP), and the fix is tracked in upstream GitHub issue #965.
RemediationAI
Patch available per vendor advisory - upgrade the @modelcontextprotocol TypeScript SDK to a release later than 1.25.1 that contains the UriTemplate fix; the exact patched version is not stated in the provided data, so pin to the current fixed release referenced in upstream GitHub issue https://github.com/modelcontextprotocol/typescript-sdk/issues/965 and confirm it against the VulnCheck advisory https://www.vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos before rollout. If you cannot upgrade immediately, avoid exposing resource templates that use exploded array expansions (patterns like {/var*} or {?var*}) to untrusted callers, and validate or length-cap incoming URIs before they reach UriTemplate matching. As a stronger control, run URI matching in a worker thread or under a per-operation timeout so a stalled match cannot freeze the main event loop - the trade-off is added latency and code complexity. Placing authentication or network ACLs in front of the MCP endpoint reduces exposure at the cost of blocking some legitimate integrations.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today