One HTTP request can exhaust memory on an MCP TypeScript SDK server

On October 15, 2026 the MCP TypeScript SDK published two High advisories for servers reachable over HTTP.

GHSA-46jr-4wx8-v453 says servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are needed, unless requests are authenticated before they reach the SDK. The advisory says the risk is highest for McpServer tools whose input contains an array or a record, and that stdio-only servers are not affected. It rates the issue High, CVSS 3.1 score 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and names CWE-770. It lists no CVE ID.

The advisory's version data lists @modelcontextprotocol/sdk at >= 1.3.0, < 1.32.0, patched in 1.32.0, and @modelcontextprotocol/server at >= 2.0.0, < 2.3.0, patched in 2.3.0. The advisory text says @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0. This note uses the version data for the affected range. The patched versions add an McpServer option, maxToolInputElements, that is off by default. The advisory says upgrading alone changes nothing. Set maxToolInputElements just above the largest input the tools need. It counts array elements and object keys in a call's arguments, and a call over the limit gets an isError: true result. Also set maxRequestBodySize on the transport or createMcpHandler(), because the option covers tool arguments only. If the app parses the body itself, for example with express.json() or Fastify, set that parser's limit. The advisory says maxRequestBodySize needs @modelcontextprotocol/sdk 1.30.1 or @modelcontextprotocol/server 2.1.0, and that below that a reverse proxy is the option if you cannot upgrade.

GHSA-f897-62hf-6gxq says MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block the server from serving anyone else. No credentials were needed, unless the application authenticates requests before they reach the SDK. The advisory says a body parser such as express.json() does not limit batch length, and that servers that only use stdio are not affected. It rates the issue High, CVSS 3.1 score 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and names CWE-770. It lists no CVE ID.

The advisory's version data lists @modelcontextprotocol/sdk at >= 1.10.0, < 1.30.1, patched in 1.30.1; @modelcontextprotocol/server at >= 2.0.0, < 2.1.0, patched in 2.1.0; @modelcontextprotocol/node at >= 2.0.0, < 2.1.0, patched in 2.1.0; and @modelcontextprotocol/hono at >= 2.0.0, < 2.0.1, patched in 2.0.1. The advisory text says @modelcontextprotocol/sdk 1.10.0 through 1.30.0, @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0, and @modelcontextprotocol/hono 2.0.0. This note uses the version data for the affected range. After the fix, bodies over 4 MiB get 413, and batches over 100 messages get 400. The advisory says to raise maxRequestBodySize if clients send larger bodies, and to upgrade every 2.x package that is installed. If you cannot upgrade yet, the advisory says to cap request body size in a reverse proxy.