PT-2026-1337 · Anthropic · Mcp Typescript Sdk

Weblover · Publicado 2026-01-05 · Atualizado 2026-02-02 · CVE-2026-0621

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Anthropic's MCP TypeScript SDK versions up to and including 1.25.1

Description The software contains a regular expression denial of service (ReDoS) issue within the UriTemplate class when handling RFC 6570 exploded array patterns. The dynamically generated regular expression used for URI matching includes nested quantifiers, which can lead to catastrophic backtracking when processing specifically crafted inputs. This can cause excessive CPU usage, potentially making the Node.js process unresponsive and resulting in a denial of service. An attacker can exploit this by providing a malicious URI.

Recommendations Upgrade to version 1.25.2.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2026-0621

GHSA-8R9Q-7V3J-JR4G

Produtos afetados

Mcp Typescript Sdk

Referências · 17

• 🔥 https://github.com/modelcontextprotocol/typescript-sdk/issues/965 · Exploit
• https://github.com/modelcontextprotocol/typescript-sdk/commit/b392f02ffcf37c088dbd114fedf25026ec3913d3 · Nota
• https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v1.25.2 · Nota
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-cqwc-fm46-7fff · Nota
• https://github.com/modelcontextprotocol/typescript-sdk · Nota
• https://twitter.com/CVEnew/status/2008346560485327335 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2008425434774393135 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0621 · Nota de Segurança
• https://twitter.com/RoiTabach/status/2008934255762473466 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8r9q-7v3j-jr4g · Aviso do Fabricante
• https://twitter.com/jer_mchugh/status/2017023644271042667 · Publicação no Twitter
• https://twitter.com/transilienceai/status/2018230670217158923 · Publicação no Twitter
• https://vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos · Nota
• https://t.me/cveNotify/150353 · Publicação no Telegram
• https://twitter.com/jer_mchugh/status/2017023641666437421 · Publicação no Twitter