CVE-2026-39313
1 advisory.
npm/mcp-framework CVE-2026-39313: high
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
Action: Upgrade mcp-framework to 0.2.22 or later.
npm i mcp-framework@0.2.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.22 | - |
Fixed versions
| 0.2.22 |
Sources
- osv: GHSA-353c-v8x9-v7c3
- https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3
- https://nvd.nist.gov/vuln/detail/CVE-2026-39313
- https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524
- https://github.com/QuantGeekDev/mcp-framework
CVE-2026-39313 · published · modified · JSON