Mcp Typescript Sdk
Monthly
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. [CVSS 7.1 HIGH]
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
DNS rebinding against localhost-bound MCP TypeScript SDK servers (npm @modelcontextprotocol/sdk prior to 1.24.0) lets a malicious website bypass the browser same-origin policy and drive an unauthenticated MCP server on the user's machine, invoking exposed tools and reading resources on the victim's behalf. The flaw only materialises when an HTTP-based transport (StreamableHTTPServerTransport or SSEServerTransport) is bound to localhost, runs without authentication, and leaves enableDnsRebindingProtection at its insecure default; stdio-based and authenticated servers are unaffected, and the vendor notes that unauthenticated local HTTP servers violate MCP security best practices. The assessed vector is unauthenticated but requires the victim to visit an attacker-controlled page and a working DNS rebinding setup (CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N), exploitation is not confirmed in the wild, no public exploit code was identified at time of analysis, and EPSS is only 0.03% (8th percentile).
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. [CVSS 7.1 HIGH]
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
DNS rebinding against localhost-bound MCP TypeScript SDK servers (npm @modelcontextprotocol/sdk prior to 1.24.0) lets a malicious website bypass the browser same-origin policy and drive an unauthenticated MCP server on the user's machine, invoking exposed tools and reading resources on the victim's behalf. The flaw only materialises when an HTTP-based transport (StreamableHTTPServerTransport or SSEServerTransport) is bound to localhost, runs without authentication, and leaves enableDnsRebindingProtection at its insecure default; stdio-based and authenticated servers are unaffected, and the vendor notes that unauthenticated local HTTP servers violate MCP security best practices. The assessed vector is unauthenticated but requires the victim to visit an attacker-controlled page and a working DNS rebinding setup (CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N), exploitation is not confirmed in the wild, no public exploit code was identified at time of analysis, and EPSS is only 0.03% (8th percentile).