Evidence · DiggingBeagle record
MCP TypeScript SDK unbounded HTTP body and JSON-RPC batch advisory
MCP TypeScript SDK HTTP body/batch denial-of-service advisory with exact patched package versions, 4 MiB response 413 and 100-message response 400. Only remotely reachable affected HTTP transports are in scope.
- Source role
- primary disclosure
Evidence record
MCP TypeScript SDK HTTP body/batch denial-of-service advisory with exact patched package versions, 4 MiB response 413 and 100-message response 400. Only remotely reachable affected HTTP transports are in scope.
Claim-level citations (3)
- supportsMCP TypeScript HTTP services could exhaust resources on oversized bodies or batches: The advisory states affected Streamable HTTP MCP servers did not bound POST size or batch message count, allowing memory exhaustion or denial of service depending on deployment exposure.
Advisory summary; transport and handler limits
- supportsMCP TypeScript HTTP services could exhaust resources on oversized bodies or batches: The listed patched releases introduce a default 4 MiB body limit and 100-message batch cap with 413 and 400 responses, respectively.
Advisory fix; patched versions and enforced limits
- supportsMCP TypeScript HTTP services could exhaust resources on oversized bodies or batches: The advisory limits the exposure to affected HTTP server transports; it says stdio-only servers are not affected and an HTTP body parser alone does not cap JSON-RPC batch length.
Am I affected? and Fix, GHSA-f897-62hf-6gxq