Evidence · DiggingBeagle record
MCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP size and batch limits
Maintainer advisory for unbounded HTTP bodies and JSON-RPC batches in several SDK and HTTP adapter packages.
- Source role
- primary disclosure
Evidence record
Maintainer advisory for unbounded HTTP bodies and JSON-RPC batches in several SDK and HTTP adapter packages.
Claim-level citations (2)
- supportsMCP HTTP adapters accepted unbounded request bodies and JSON-RPC batches: The corrected packages independently reject HTTP request bodies above 4 MiB and batches above 100 JSON-RPC messages unless operators change the defaults.
Fix; patched adapter versions
- supportsMCP HTTP adapters accepted unbounded request bodies and JSON-RPC batches: Maintainers report that affected HTTP transports placed no limit on incoming POST bytes or JSON-RPC batch message counts.
Summary; affected versions