MCP SDK Vulnerability Allows HTTP Memory Exhaustion via Unbounded Inputs
Attackers can crash Model Context Protocol servers by sending large arrays, causing out-of-memory errors without needing credentials.
Key points
- CVE-2026-111768 affects @modelcontextprotocol/sdk versions 1.3.0 to 1.31.0.
- The @modelcontextprotocol/server package is vulnerable in versions 2.0.0 through 2.2.0.
- Patches exist in SDK 1.32.0 and server 2.3.0, but require manual configuration.
Model Context Protocol servers running specific npm packages are exposed to a high-severity memory exhaustion flaw. The vulnerability, tracked as CVE-2026-111768, allows unauthenticated attackers to crash services by submitting requests with excessive array elements or object keys. This issue impacts any server accessible over HTTP to clients that are not fully trusted.
Root cause
The affected SDK versions failed to limit the number of array elements or object keys validated during a single request. A single HTTP request, staying within the default four-megabyte size limit, could consume all available server memory. This resulted in the process aborting with a JavaScript heap out of memory error. The flaw exists because the validation logic did not enforce a cap on structural complexity within the payload.
Attack path
An attacker needs no credentials to exploit this flaw, unless the server enforces authentication before requests reach the SDK. The risk is highest for McpServer tools that accept inputs containing arrays or records. Standard input/output-only servers are not affected by this specific vector. Attackers can trigger the crash by sending a single request designed to maximise the number of validated elements within the allowed payload size.
Affected versions
- @modelcontextprotocol/sdk versions 1.3.0 through 1.31.0
- @modelcontextprotocol/server versions 2.0.0 through 2.2.0
Mitigation
- Upgrade to @modelcontextprotocol/sdk 1.32.0 or later.
- Upgrade to @modelcontextprotocol/server 2.3.0 or later.
- Set the maxToolInputElements option to a value above your largest expected input.
- Lower the request size limit using maxRequestBodySize or your web framework’s parser settings.
Signals worth monitoring
Teams should watch for sudden spikes in server memory usage followed by immediate process termination. Look for JavaScript heap out of memory errors in application logs, especially after receiving HTTP requests from untrusted sources. Monitor for abnormal request patterns where payloads are large but contain minimal actual data, suggesting structural complexity attacks. Check whether your logging systems capture request sizes and element counts to identify anomalies early.
What to do and how to stay safe: Model Context Protocol
- Audit your npm dependencies to identify if you are running vulnerable versions of the MCP SDK or server packages.
- Implement strict request size limits at the reverse proxy or web framework level to reduce exposure until patches are applied.
- Review server logs for out-of-memory crashes that correlate with incoming HTTP traffic from external or untrusted clients.
- Plan to upgrade to the patched versions and configure the new maxToolInputElements option according to your operational needs.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do I need credentials to exploit this vulnerability?
No, credentials are not required unless you authenticate requests before they reach the SDK.
Are stdio-only servers affected?
No, stdio-only servers are not affected by this HTTP-based memory exhaustion flaw.
Does upgrading alone fix the issue?
No, upgrading alone changes nothing; you must also configure the maxToolInputElements option.
