MCP TypeScript SDK: one HTTP request within the default size limit could exhaust server memory
- Product
- MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/server)
- CVE
- CVE-2026-111768
- Affected
- @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0
- Fixed in
- @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0
Last verified against sources: October 26, 2026
Am I affected?
MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/server): affected @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0. Fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.
- Check your version: run
npm ls @modelcontextprotocol/sdk. Versions >= 1.3.0, < 1.32.0 of @modelcontextprotocol/sdk are affected. [1] - Check your version: run
npm ls @modelcontextprotocol/server. Versions >= 2.0.0, < 2.3.0 of @modelcontextprotocol/server are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @modelcontextprotocol/sdk@1.32.0(first patched version 1.32.0). [1] - Upgrade to the fixed version: run
npm install @modelcontextprotocol/server@2.3.0(first patched version 2.3.0). [1] - Set
maxToolInputElementsjust above the largest input your tools need, for examplenew McpServer(info, { maxToolInputElements: 10_000 }). [1] - Lower the request size limit to what your tools need by setting
maxRequestBodySizeon the transport orcreateMcpHandler(). [1] - If you parse the body yourself, for example with
express.json()or Fastify, set that parser's limit. [1] - If you cannot upgrade yet, make the size-limit change;
maxRequestBodySizeneeds@modelcontextprotocol/sdk1.30.1 or@modelcontextprotocol/server2.1.0, and below that use a reverse proxy. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- In affected versions, servers put no limit on how many array elements and object keys they checked in one request. [1]
- One HTTP request within the default 4 MiB size limit could use up the server's memory. [1]
- The process then stopped with the message
JavaScript heap out of memory. [1] - No credentials are needed, unless requests are authenticated before they reach the SDK. [1]
Impact
What was done
Sources
- GHSA-46jr-4wx8-v453 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-111768] MCP TypeScript SDK: one HTTP request within the default size limit could exhaust server memory
Product: MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/server) | Affected: @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0 | Fixed in: @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0
Summary: In affected versions, servers put no limit on how many array elements and object keys they checked in one request.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-111768-mcp-typescript-sdk-modelcontextprotocol-sdk-and-modelcontextprotocol-serverCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-111768
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.