The October 15 maintainer advisory identifies two independent paths to service exhaustion in Streamable HTTP transports: the server accepted large POST bodies without a transport-level bound, and large JSON-RPC batches could monopolize request processing. An application's general JSON parser size limit does not necessarily constrain how many JSON-RPC…
Inspect the ClaimsCase · DiggingBeagle record
MCP HTTP adapters accepted unbounded request bodies and JSON-RPC batches
Several official TypeScript MCP HTTP components previously allowed unrestricted request sizes or batch counts. Fixed versions impose separate 4 MiB and 100-message defaults.
Scope
Streamable HTTP MCP servers with affected TypeScript package or adapter versions; not stdio-only applications.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Maintainer GHSA-f897-62hf-6gxq states affected Streamable HTTP transports permitted unbounded POST bodies and JSON-RPC batch lengths. Patched versions default to HTTP 413 above 4 MiB and 400 beyond 100 messages, but every installed transport adapter and outer body parser must be checked.
Assessed Oct 17, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MCP-TS-HTTP-LIMITS · CLM-MCP-TS-UNBOUNDED-HTTP · MCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP size and batch limits · MCP TypeScript SDK GHSA-46jr-4wx8-v453: tool input element exhaustion
At a glance
No verified attacker activity or real-world downtime from this vulnerability family. Custom reverse proxies and framework parsers change precise resource consumption and need separate testing.
Limits and uncertaintyFull account
The October 15 maintainer advisory identifies two independent paths to service exhaustion in Streamable HTTP transports: the server accepted large POST bodies without a transport-level bound, and large JSON-RPC batches could monopolize request processing. An application's general JSON parser size limit does not necessarily constrain how many JSON-RPC messages appear in one permitted body.
The advisory specifies patched versions independently for @modelcontextprotocol/sdk (1.30.1), @modelcontextprotocol/server (2.1.0), @modelcontextprotocol/node (2.1.0) and @modelcontextprotocol/hono (2.0.1). The corrected defaults reject bodies above 4 MiB with HTTP 413 and batches above 100 messages with HTTP 400. Administrators can configure body sizes for larger legitimate workloads. Applications must update every affected adapter they actually run; a server-core change alone can leave the HTTP adapter vulnerable.
These measures do not address the separate within-limit tool-argument amplification described in GHSA-46jr-4wx8-v453. They protect different stages of transport admission and schema work. No published victim count or exploited campaign is established.
Timeline
- Oct 15, 2026disclosure
Public disclosure
Claims & evidence
CLM-MCP-TS-HTTP-LIMITSThe corrected packages independently reject HTTP request bodies above 4 MiB and batches above 100 JSON-RPC messages unless operators change the defaults.supported
Basis: reported finding
- supportsMCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP size and batch limitsprimary disclosure
Fix; patched adapter versions
CLM-MCP-TS-UNBOUNDED-HTTPMaintainers report that affected HTTP transports placed no limit on incoming POST bytes or JSON-RPC batch message counts.supported
Basis: reported finding
- supportsMCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP size and batch limitsprimary disclosure
Summary; affected versions
Controls and mitigations
- Upgrade each installed SDK, server and HTTP adapter package to its fixed release.
- Verify both byte-size HTTP 413 and JSON-RPC batch 400 behavior at ingress; test concurrent requests.
- Upgrade the installed SDK and all HTTP adapter packages to each component's separately listed patched version; verify 413 for overlimit request bodies and 400 for overlimit JSON-RPC batches.
- Bound body size in the actual reverse proxy or request parser as well as the MCP transport; an Express JSON parser does not by itself limit batch-message count.
Unknowns and contradictions
- No verified attacker activity or real-world downtime from this vulnerability family.
- Custom reverse proxies and framework parsers change precise resource consumption and need separate testing.
Sources and citation
Material revision history
- Oct 17, 2026 · Published version · first publication · revision 163