npm/@modelcontextprotocol/server CVE-2026-111768: high 7.5

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

Action: Upgrade @modelcontextprotocol/server to 2.3.0 or later.

npm i @modelcontextprotocol/server@2.3.0

Affected

Fixed versions

Sources

• osv: GHSA-46jr-4wx8-v453#npm/@modelcontextprotocol/server
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453
• https://github.com/modelcontextprotocol/typescript-sdk/pull/2926
• https://github.com/modelcontextprotocol/typescript-sdk/pull/2927
• https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37
• https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f
• https://github.com/modelcontextprotocol/typescript-sdk

CVE-2026-111768 · published 2026-10-20T20:06:35Z · modified 2026-10-20T20:15:05.222078887Z · JSON