Skip to content
Threat Feed
Subscribe

Product

@Modelcontextprotocol/Server (2.0.0-2.2.0)

1 brief RSS
medium advisory

Model Context Protocol TypeScript SDK: Memory exhaustion via array and object validation (CVE-2026-111768)

The Model Context Protocol (MCP) TypeScript SDK is vulnerable to a denial-of-service condition where unauthenticated HTTP requests can exhaust server memory by bypassing array element and object key validation limits.

@modelcontextprotocol/sdk +1
1t 1c