EUVD-2026-23300
GHSA-353c-v8x9-v7c3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated request to the pre-auth HTTP read path (AV:N/AC:L/PR:N/UI:N); impact is availability-only memory exhaustion, so C:N/I:N/A:H.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6Blast Radius
ecosystem impact- 91 npm packages depend on mcp-framework (89 direct, 2 indirect)
Ecosystem-wide dependent count for version 0.2.22.
DescriptionGitHub Advisory
Summary
The readRequestBody() function in src/transports/http/server.ts concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request.
Details
File: src/transports/http/server.ts, lines 224-240
private async readRequestBody(req: IncomingMessage): Promise<any> {
return new Promise((resolve, reject) => {
let body = '';
req.on('data', (chunk) => {
body += chunk.toString(); // No size limit
});
req.on('end', () => {
try {
const parsed = body ? JSON.parse(body) : null;
resolve(parsed);
} catch (error) {
reject(error);
}
});
req.on('error', reject);
});
}A maxMessageSize configuration value exists in DEFAULT_HTTP_STREAM_CONFIG (4MB, defined in src/transports/http/types.ts line 124) but is never enforced in readRequestBody(). This creates a false sense of security.
PoC
Local testing with 50MB POST payloads against the vulnerable readRequestBody() function:
| Trial | Payload | RSS growth | Time | Result |
|---|---|---|---|---|
| 1 | 50MB | +197MB | 42ms | Vulnerable |
| 2 | 50MB | +183MB | 46ms | Vulnerable |
| 3 | 50MB | +15MB | 43ms | Vulnerable |
| 4 | 50MB | +14MB | 32ms | Vulnerable |
| 5 | 50MB | +65MB | 38ms | Vulnerable |
Reproducibility: 5/5 (100%)
Impact
- Denial of Service: Any mcp-framework HTTP server can be crashed by a single large POST request to /mcp
- No authentication required: readRequestBody() executes before any auth checks (auth is opt-in, default is no auth)
- Dead config: maxMessageSize exists but is never enforced, giving a false sense of security
- Affected: All applications using mcp-framework HttpStreamTransport (60,000 weekly npm downloads)
CWE-770: Allocation of Resources Without Limits or Throttling Suggested CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Suggested Fix
Enforce maxMessageSize in readRequestBody():
private async readRequestBody(req: IncomingMessage): Promise<any> {
const maxSize = this._config.maxMessageSize || 4 * 1024 * 1024;
return new Promise((resolve, reject) => {
let body = '';
let size = 0;
req.on('data', (chunk) => {
size += chunk.length;
if (size > maxSize) {
req.destroy();
reject(new Error('Request body too large'));
return;
}
body += chunk.toString();
});
// ...
});
}Disclosure Timeline
This report follows coordinated disclosure. I request a 90-day window before public disclosure.
Reporter: Raza Sharif, CyberSecAI Ltd (contact@agentsign.dev)
AnalysisAI
Denial of service in mcp-framework (npm) versions <= 0.2.21 lets a remote unauthenticated attacker crash any server using the HttpStreamTransport by sending a single oversized HTTP POST to /mcp, exhausting memory. The readRequestBody() function concatenates request-body chunks into a string with no cap, and although a 4MB maxMessageSize config value exists it is never enforced. Publicly available exploit code exists (SSVC 'poc'), a vendor patch shipped in 0.2.22, and EPSS is low (0.14%, 34th percentile).
Technical ContextAI
mcp-framework is a Node.js/TypeScript framework for building Model Context Protocol (MCP) servers; the flaw lives in its HTTP streaming transport (src/transports/http/server.ts). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): readRequestBody() attaches a 'data' listener that appends every incoming chunk to an in-memory JavaScript string (body += chunk.toString()) until 'end', then JSON.parse()s it. Because there is no running byte counter or early abort, the buffered body - plus the transient allocations from toString() and JSON.parse() - grows unbounded with the client-controlled payload. A maxMessageSize (4MB) default was defined in types.ts but never wired into the read path, so the intended throttle was dead code.
RemediationAI
Vendor-released patch: upgrade mcp-framework to 0.2.22 or later, which enforces maxMessageSize inside readRequestBody() (fix commit https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524; advisory https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3). If you cannot upgrade immediately, place the MCP endpoint behind a reverse proxy (nginx/Envoy) or API gateway and enforce a request body size limit (for example nginx client_max_body_size 4m), which caps payloads before they reach Node - the trade-off is that legitimate large MCP messages will be rejected, so tune the limit to your protocol needs. Additionally, restrict network access to the /mcp endpoint (bind to localhost or an internal interface, or require the framework's opt-in authentication) so untrusted clients cannot reach readRequestBody() at all; note this reduces exposure but does not fix the underlying unbounded allocation.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today