High · published January 6, 2026
⚡ Crafty inputs can freeze your server! An attacker can trigger a nasty regular expression denial of service (ReDoS) vulnerability in the Anthropic MCP TypeScript SDK, specifically in versions up to 1.25.1. 🔥 Think of it like an assembly line that stalls when a worker misreads the instructions. Instead of smoothly processing, it gets stuck in an endless loop of conflicting commands, driving productivity to a halt. If exploited, your Node.js process could become entirely unresponsive, leaving users unable to access your services. This could lead to a frustrating experience for your users and potential revenue loss due to downtime. Imagine your business grinding to a halt because of a sneaky crafted URI—yikes!
Think of it like an assembly line that stalls when a worker misreads the instructions. Instead of smoothly processing, it gets stuck in an endless loop of conflicting commands, driving productivity to a halt. This vulnerability arises from nested quantifiers in a dynamically generated regular expression in the UriTemplate class. When processing certain RFC 6570 exploded array patterns, this can cause catastrophic backtracking, leading to excessive CPU consumption and denial of service.
If exploited, your Node.js process could become entirely unresponsive, leaving users unable to access your services. This could lead to a frustrating experience for your users and potential revenue loss due to downtime. Imagine your business grinding to a halt because of a sneaky crafted URI—yikes! To remediate this, upgrade your MCP TypeScript SDK to version 1.25.2 or later, which addresses this vulnerability. Regularly audit your dependencies and ensure you’re checking for updates to avoid similar issues in the future. You've got this! Take these steps and keep your server running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| lfprojects/mcp_typescript_sdk | ≤ 1.25.1 | — |