---
title: MCP TypeScript SDK CVE-2026-111768: one HTTP request can exhaust an MCP server's memory during validation; upgrading alone does not fix it | ctxsec
url: https://ctxsec.com/items/mcp-typescript-sdk-cve-2026-111768-tool-input-memory-exhaustion
description: "Official MCP TypeScript SDK servers put no cap on how many array elements and object keys they validated per request, so one unauthenticated HTTP call within the default 4 MiB body limit could crash the process with a JavaScript heap OOM (CVSS 7.5). @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0 add a maxToolInputElements option, but it is off by default, so operators must set it and also lower maxRequestBodySize. stdio-only servers are not affected."
status: "official (modelcontextprotocol/typescript-sdk advisory GHSA-46jr-4wx8-v453, Oct 20)"
published: 2026-11-01
---

> Official MCP TypeScript SDK servers put no cap on how many array elements and object keys they validated per request, so one unauthenticated HTTP call within the default 4 MiB body limit could crash the process with a JavaScript heap OOM (CVSS 7.5). @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0 add a maxToolInputElements option, but it is off by default, so operators must set it and also lower maxRequestBodySize. stdio-only servers are not affected.

[← Context & Harness Attacks](/context) · [markdown](/items/mcp-typescript-sdk-cve-2026-111768-tool-input-memory-exhaustion.md)

official (modelcontextprotocol/typescript-sdk advisory GHSA-46jr-4wx8-v453, Oct 20)

2026-11-01

### MCP TypeScript SDK CVE-2026-111768: one HTTP request can exhaust an MCP server's memory during validation; upgrading alone does not fix it

The Model Context Protocol maintainers published **GHSA-46jr-4wx8-v453** / **CVE-2026-111768** (CVSS 3.1 **7.5**) for the official TypeScript SDK on **Oct 20**. We are adding it now because it affects nearly every Node-based remote MCP server.

- **Affected:** `@modelcontextprotocol/sdk` 1.3.0 to 1.31.0 and `@modelcontextprotocol/server` 2.0.0 to 2.2.0, when untrusted clients can reach the server over HTTP. Risk is highest for `McpServer` tools whose input schema contains arrays or records. **stdio-only servers are not affected.**
- **Bug:** no limit on how many array elements and object keys were validated in one request, so a single body under the default 4 MiB limit could drive the process to `JavaScript heap out of memory`. No credentials are needed unless you authenticate before the SDK.
- **Fix (opt-in):** 1.32.0 / 2.3.0 add `maxToolInputElements`, which is **off by default**. The advisory says "upgrading alone changes nothing".

**What to do:** (1) upgrade, then set `new McpServer(info, { maxToolInputElements: N })` just above your largest legitimate input; (2) lower `maxRequestBodySize` on the transport or `createMcpHandler()`, or your own `express.json()`/Fastify limit, to what your tools need (needs sdk 1.30.1+ / server 2.1.0+, otherwise use a reverse proxy); (3) authenticate before the SDK sees the body. If a vendor ships you a remote MCP server, ask whether both settings are configured.

Sources: [modelcontextprotocol/typescript-sdk advisory GHSA-46jr-4wx8-v453 (CVE-2026-111768)](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453) · [GitHub advisory database entry](https://github.com/advisories/GHSA-46jr-4wx8-v453)