CVE-2026-0621
📋 TL;DR
This CVE describes a regular expression denial of service (ReDoS) vulnerability in Anthropic's MCP TypeScript SDK. Attackers can exploit this by sending specially crafted URIs that cause catastrophic backtracking in the UriTemplate class, leading to excessive CPU consumption and denial of service. Any application using vulnerable versions of the MCP TypeScript SDK is affected.
💻 Affected Systems
- Anthropic MCP TypeScript SDK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service where the Node.js process becomes unresponsive, requiring process restart and potentially affecting availability of dependent services.
Likely Case
Degraded performance or temporary unresponsiveness of the affected service until the malicious request processing completes or times out.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place to detect and block malicious patterns.
🎯 Exploit Status
Exploitation requires sending specially crafted URIs to endpoints using vulnerable UriTemplate patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.25.2 or later
Vendor Advisory: https://github.com/modelcontextprotocol/typescript-sdk/issues/965
Restart Required: Yes
Instructions:
1. Update package.json to use @modelcontextprotocol/sdk version 1.25.2 or later. 2. Run npm update @modelcontextprotocol/sdk. 3. Restart the Node.js application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject URIs with suspicious patterns before they reach the UriTemplate parser.
Request Timeout Configuration
allConfigure request timeouts to limit how long URI processing can take, preventing prolonged denial of service.
🧯 If You Can't Patch
- Implement rate limiting to restrict the number of requests from single sources
- Deploy WAF rules to detect and block URI patterns that trigger ReDoS
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for @modelcontextprotocol/sdk version <=1.25.1Check Version:
npm list @modelcontextprotocol/sdkVerify Fix Applied:
Verify @modelcontextprotocol/sdk version is 1.25.2 or higher in package.json after update📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Request timeouts on URI processing endpoints
- Unusually long processing times for specific URI patterns
Network Indicators:
- Repeated requests with complex URI patterns from single sources
- Spikes in request volume to specific endpoints
SIEM Query:
source="application.logs" AND (message="CPU spike" OR message="request timeout") AND uri="*{*"