npm/@modelcontextprotocol/sdk CVE-2026-111768: high 7.5
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
Action: Upgrade @modelcontextprotocol/sdk to 1.32.0 or later.
npm i @modelcontextprotocol/sdk@1.32.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 1.32.0 | - |
Fixed versions
| 1.32.0 |
Sources
- osv: GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2926
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2927
- https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37
- https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f
- https://github.com/modelcontextprotocol/typescript-sdk
CVE-2026-111768 · published · modified · JSON