CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS
Attackers can cause denial of service in applications using the MCP TypeScript SDK by sending malicious URIs that trigger catastrophic backtracking in URI template processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0621?
CVE-2026-0621 is a high-severity denial of service vulnerability in Anthropic MCP TypeScript SDK, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.
Weakness: CWE-1333
Which versions are affected by CVE-2026-0621?
2 open source packages ship an affected version, including @modelcontextprotocol/sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@modelcontextprotocol/sdk npm | From 1.3.0 | 1.25.2 |
@modelcontextprotocol/sdk npm | From 1.3.0 | 1.25.2 |
Products include Lfprojects Mcp Typescript Sdk.
How do I fix CVE-2026-0621?
Upgrade @modelcontextprotocol/sdk to 1.25.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-0621 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0621 exists.
Other vulnerabilities in Anthropic MCP TypeScript SDK
Sources
Also known as CLSA-2026-1789750026, ECHO-6585-27e0-f504, GHSA-8r9q-7v3j-jr4g, MINI-38mh-cmqx-4f24, MINI-434q-rwv3-qx4x, MINI-c8pg-4wwg-537f and 3 more.