@Modelcontextprotocol/Server (2.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/@modelcontextprotocol/server-2.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:02:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgModel Context Protocol TypeScript SDK: Denial-of-service via unbounded JSON-RPC payloadshttps://feed.craftedsignal.io/briefs/2026-10-mcp-typescript-sdk-dos-eb09b16e/Thu, 29 Oct 2026 21:02:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mcp-typescript-sdk-dos-eb09b16e/The Model Context Protocol (MCP) TypeScript SDK is vulnerable to remote denial-of-service due to a lack of request body size and JSON-RPC batch length limits, allowing unauthenticated attackers to exhaust server resources.The Model Context Protocol (MCP) TypeScript SDK fails to enforce limits on HTTP request body sizes and the number of messages within a JSON-RPC batch. This vulnerability allows an unauthenticated attacker to send excessively large payloads or large batches to an MCP server, leading to memory exhaustion or service unavailability. Deployment configurations utilizing stdio are not affected by this vulnerability.

Impact

Successful exploitation results in a denial-of-service condition, potentially crashing the server or preventing legitimate requests from being processed due to resource exhaustion.

Recommendation

  • Update affected packages immediately to the patched versions:
  • For 1.x environments: Update @modelcontextprotocol/sdk to 1.30.1 or later.
  • For 2.x environments: Update @modelcontextprotocol/server to 2.1.0, @modelcontextprotocol/node to 2.1.0, and @modelcontextprotocol/hono to 2.0.1 or later.
  • If immediate patching is not possible, implement a request body size limit at the reverse proxy or API gateway level to mitigate payload-based exhaustion.
  • Review MCP server configurations to verify if client trust boundaries allow unauthenticated access to HTTP transport endpoints.
]]>highadvisorydenial-of-servicemcpnodejstypescript