MCP TypeScript SDK CVE-2026-111768

Requires an affected MCP server reachable over the HTTP transport (stdio-only servers are explicitly NOT affected) that registers McpServer tools whose arguments accept arrays or records, with untrusted clients able to send tools/call requests. No authentication is needed unless requests are authenticated before reaching the SDK, and no user interaction is required; the attack works against default configurations because maxToolInputElements did not exist (and is off by default even after patching) and the default 4 MiB maxRequestBodySize is large enough to carry an exhausting payload. Limiting factors that reduce real-world exposure: upstream authentication/proxy filtering, stdio-only deployment, tools that accept no array/object inputs, and an already-lowered maxRequestBodySize.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a single HTTP request within the default 4 MiB body limit triggers unbounded validation of array elements and object keys (CWE-770), exhausting the Node.js heap and crashing the process with no credentials or user interaction required against affected HTTP-exposed servers. Impact is confined to availability (C:N/I:N) - there is no data exposure or code execution. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.5 rating is driven purely by easy, unauthenticated, network-reachable DoS rather than by observed attacks. The main factor tempering real-world risk is scope: only servers using the HTTP transport whose McpServer tools accept array or record inputs are exploitable, stdio-only servers are not affected, and many deployments authenticate requests before they reach the SDK. Treat this as a real patch-and-configure priority for any internet- or untrusted-client-facing MCP HTTP server, but as low urgency for stdio-only or fully authenticated internal deployments.

An attacker who can reach an affected MCP server over HTTP sends a single tools/call request - under the default 4 MiB size limit - whose arguments contain a deeply/widely nested array or object with a very large number of elements. The SDK validates every element without bound, exhausting the V8 heap and crashing the Node.js process with 'JavaScript heap out of memory', denying service to all clients. No public exploit code was identified, but the attack requires no authentication (unless requests are authenticated upstream) and low complexity, making it trivial to reproduce.