Vulnerability · Published Jan 5, 2026 · Assigned by VulnCheck
CVE-2026-0621MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS
High 8.7
In plain English
A high-severity regular-expression denial of service in MCP TypeScript SDK from Anthropic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @modelcontextprotocol/sdk | 1.25.2 | GHSA-8r9q-7v3j-jr4g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Anthropic | MCP TypeScript SDK | 0 – through 1.25.1 |
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N