PT-2026-1337 · Anthropic · Mcp Typescript Sdk

Weblover · Published 2026-01-05 · Updated 2026-02-02 · CVE-2026-0621

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Anthropic's MCP TypeScript SDK versions up to and including 1.25.1

Description The software contains a regular expression denial of service (ReDoS) issue within the UriTemplate class when handling RFC 6570 exploded array patterns. The dynamically generated regular expression used for URI matching includes nested quantifiers, which can lead to catastrophic backtracking when processing specifically crafted inputs. This can cause excessive CPU usage, potentially making the Node.js process unresponsive and resulting in a denial of service. An attacker can exploit this by providing a malicious URI.

Recommendations Upgrade to version 1.25.2.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-0621

GHSA-8R9Q-7V3J-JR4G

Affected Products

Mcp Typescript Sdk

References · 17

• 🔥 https://github.com/modelcontextprotocol/typescript-sdk/issues/965 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0621 · Security Note
• https://osv.dev/vulnerability/GHSA-8r9q-7v3j-jr4g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0621 · Vendor Advisory
• https://github.com/modelcontextprotocol/typescript-sdk/commit/b392f02ffcf37c088dbd114fedf25026ec3913d3 · Note
• https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v1.25.2 · Note
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-cqwc-fm46-7fff · Note
• https://github.com/modelcontextprotocol/typescript-sdk · Note
• https://twitter.com/CVEnew/status/2008346560485327335 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008425434774393135 · Twitter Post
• https://twitter.com/RoiTabach/status/2008934255762473466 · Twitter Post
• https://twitter.com/jer_mchugh/status/2017023644271042667 · Twitter Post
• https://twitter.com/transilienceai/status/2018230670217158923 · Twitter Post
• https://vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos · Note
• https://t.me/cveNotify/150353 · Telegram Post