GHSA-f897-62hf-6gxqhighDenial of service2026-10-27

GHSA-f897-62hf-6gxq: MCP TypeScript SDK HTTP servers had no limit on request body size or JSON-RPC batch length

MCP servers built with the official TypeScript SDK and reachable over Streamable HTTP put no limit on POST body size or on the number of messages in a JSON-RPC batch. Without credentials (unless your app authenticates first), a caller could exhaust the server's memory or block it with one long batch. Fixed in @modelcontextprotocol/sdk 1.30.1 and the 2.x server, node and hono packages.

01.

What it is

The HTTP server transports and handlers accepted request bodies of any size and JSON-RPC batches of any length. Large requests could exhaust memory, and one long batch could stop the server from serving anyone else.

A body parser such as express.json() does not protect you, because it doesn't limit batch length. stdio-only servers are not affected.

The fixed versions return 413 for bodies over 4 MiB and 400 for batches over 100 messages; a new maxRequestBodySize option raises the body limit.

02.

How to check

Affected: @modelcontextprotocol/sdk 1.10.0 through 1.30.0, and @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0 and @modelcontextprotocol/hono 2.0.0.
You are at risk if clients you don't fully trust can reach your MCP server over Streamable HTTP.

03.

How to fix

Upgrade @modelcontextprotocol/sdk to 1.30.1 or later, or on 2.x upgrade @modelcontextprotocol/server and @modelcontextprotocol/node to 2.1.0 and @modelcontextprotocol/hono to 2.0.1 or later (every one you have installed).
Until then, cap request body size in a reverse proxy in front of the server.

npm ls @modelcontextprotocol/sdk @modelcontextprotocol/server @modelcontextprotocol/node @modelcontextprotocol/hono

04.

Sources

More advisories for this tool