MCP TypeScript SDK: one HTTP request within the size limit could exhaust server memory

What's on the official record

The OSV advisory reports a HIGH-severity vulnerability in the MCP TypeScript SDK, published 20 October 2026 as GHSA-46jr-4wx8-v453 (alias CVE-2026-111768, CWE-770). The affected packages are npm/@modelcontextprotocol/sdk and npm/@modelcontextprotocol/server, in the mcp layer. In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. The advisory names fixed versions 1.32.0 and 2.3.0.

Assessment

For a platform or AI-stack owner, the record lets you check the pinned version of @modelcontextprotocol/sdk and @modelcontextprotocol/server in any MCP server you run, and patch to 1.32.0 or 2.3.0 where the deployed version is below the fixed line. The advisory states the exhaustion is reachable through a single HTTP request within the default size limit, so the check is a version comparison against the two fixed releases the record names.

For a deal team, the record lets you scope diligence on a target that runs the MCP TypeScript SDK by asking which version is deployed and whether request validation is exposed to HTTP traffic. The fixed versions give a concrete line to price remediation against in diligence.

What would change this call

A revised advisory that names additional affected versions or a different fixed line would change the patch target. Evidence that the memory exhaustion is reachable in a specific deployment would raise the urgency of the check.

What to check next

Confidence

Filed 25 October 2026 from the record dated 20 October 2026.

Sources

[1] MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation — https://github.com/advisories/GHSA-46jr-4wx8-v453