AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by MCP TypeScript SDK: one HTTP request within the default size limit could exhaust server…? What should I do?

    In affected versions, servers put no limit on how many array elements and object keys they checked in one request.

    Affected: @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0. Fixed in: @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-111768-mcp-typescript-sdk-modelcontextprotocol-sdk-and-modelcontextprotocol-server (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0. Fixed in: @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.

      • Check your version: run npm ls @modelcontextprotocol/sdk. Versions >= 1.3.0, < 1.32.0 of @modelcontextprotocol/sdk are affected.
      • Check your version: run npm ls @modelcontextprotocol/server. Versions >= 2.0.0, < 2.3.0 of @modelcontextprotocol/server are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install @modelcontextprotocol/sdk@1.32.0 (first patched version 1.32.0).
      2. Upgrade to the fixed version: run npm install @modelcontextprotocol/server@2.3.0 (first patched version 2.3.0).
      3. Set maxToolInputElements just above the largest input your tools need, for example new McpServer(info, { maxToolInputElements: 10_000 }).
      4. Lower the request size limit to what your tools need by setting maxRequestBodySize on the transport or createMcpHandler().
      5. If you parse the body yourself, for example with express.json() or Fastify, set that parser's limit.
      6. If you cannot upgrade yet, make the size-limit change; maxRequestBodySize needs @modelcontextprotocol/sdk 1.30.1 or @modelcontextprotocol/server 2.1.0, and below that use a reverse proxy.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-111768-mcp-typescript-sdk-modelcontextprotocol-sdk-and-modelcontextprotocol-server (opens external site)

      Did this work for you?

    Add your answer or comment