MCP TypeScript SDK at a glance
On October 27, 2026, the Model Context Protocol project published new advisories for its official SDKs: HTTP servers built with the TypeScript SDK had no request size or batch limits, and the Python SDK accepted tokens meant for other services. Upgrade to TypeScript sdk 1.32.0 or Python mcp 1.30.0.
MCP TypeScript SDK: status
- Affected
- TypeScript: @modelcontextprotocol/sdk before 1.32.0 and @modelcontextprotocol/server before 2.3.0 (HTTP server memory exhaustion, token audience); @modelcontextprotocol/sdk 1.10.0 to 1.30.0 plus server and node 2.0.0 and hono 2.0.0 (no body-size or batch limit)
- TypeScript clients: @modelcontextprotocol/sdk before 1.32.0 and @modelcontextprotocol/client before 2.3.0 (cross-origin redirects)
- Python: mcp 1.x before 1.30.0 and 2.0.0 through 2.1.1 (token audience, cross-origin redirects, output-schema $ref fetches)
- CVE identifiers
- Status as of
What changed with MCP TypeScript SDK
On October 27, 2026, the Model Context Protocol project published four GitHub security advisories for its official SDKs, a week after an October 20 batch for the TypeScript SDK. None is known to be exploited, but together they affect most MCP servers and clients that talk over HTTP. Servers that only use stdio are not affected by the server-side issues.
The high-severity one, GHSA-f897-62hf-6gxq (CVSS 7.5, no CVE yet), says HTTP servers built with the TypeScript SDK put no limit on POST body size or on the number of messages in a JSON-RPC batch, so a client without credentials could exhaust memory or block the server. The project notes that a body parser such as express.json() does not protect you, because it does not limit batch length. Fixed versions now reject bodies over 4 MiB and batches over 100 messages, with a new maxRequestBodySize option. On October 20 the project had already fixed CVE-2026-111768, where one request under the 4 MiB limit could still exhaust memory during validation, and CVE-2026-111767, where experimental tasks were not tied to the session that created them.
The Python SDK (package mcp) got three medium-severity fixes on October 27. CVE-2026-116684: server bearer authentication could not check a token's audience, so a valid token for another service on the same authorization server was accepted. CVE-2026-116685: client transports followed cross-origin redirects and re-sent custom headers such as X-API-Key, and on 307 or 308 redirects the request body. CVE-2026-116686: a connected server could put a URL or file:// path in a tool's output schema and make the client fetch it. The TypeScript SDK fixed the matching token-audience and redirect bugs on October 20 (CVE-2026-111771 and CVE-2026-111769).
How to fix it: MCP TypeScript SDK
1. Update
TypeScript 1.x: upgrade @modelcontextprotocol/sdk to 1.32.0 or later. TypeScript 2.x: upgrade @modelcontextprotocol/server and @modelcontextprotocol/client to 2.3.0, @modelcontextprotocol/node to 2.1.0, @modelcontextprotocol/hono to 2.0.1, @modelcontextprotocol/express to 2.0.2 and @modelcontextprotocol/server-legacy to 2.3.1 or later, whichever you have installed.
github.com (opens in a new tab)2. Update
Python: upgrade mcp to 1.30.0 or later on 1.x, or 2.2.0 or later on 2.x.
github.com (opens in a new tab)3. Workaround
Until you upgrade, cap request body size in a reverse proxy in front of HTTP MCP servers, and stop using the deprecated experimental taskStore feature.
github.com (opens in a new tab)4. Configuration
If your authorization server issues tokens for several services, make sure your MCP server's token verifier checks the audience (aud) claim.
github.com (opens in a new tab)
Instruction for your AI agent
Check package.json, lockfiles and Python requirements for @modelcontextprotocol/* packages and mcp. Propose upgrading @modelcontextprotocol/sdk below 1.32.0, any 2.x @modelcontextprotocol package below the fixed version listed in the advisories, and mcp below 1.30.0 (or below 2.2.0 on 2.x). Search the code for taskStore and for custom token verifiers that do not check the aud claim, and report them to the user.
Based on the official guidance linked below. Review it before giving it to an agent that can change your systems.
Advisories
- GHSA-f897-62hf-6gxq (TypeScript SDK body size and batch length) (opens in a new tab)github.com
- GHSA-46jr-4wx8-v453 (CVE-2026-111768) (opens in a new tab)github.com
- GHSA-22jm-h49p-29qw (CVE-2026-111767) (opens in a new tab)github.com
- GHSA-w4fh-qvv9-3v23 (CVE-2026-116684, Python SDK) (opens in a new tab)github.com
- GHSA-5h93-6whr-6q8j (CVE-2026-116685, Python SDK) (opens in a new tab)github.com
- GHSA-rwrf-2pqf-9j8j (CVE-2026-116686, Python SDK) (opens in a new tab)github.com
Where to compare MCP TypeScript SDK
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why MCP TypeScript SDK matters for businesses
If you build MCP servers or connect agents to client systems over MCP, these are routine but worth doing now: update the SDK, make sure your token verifier checks the audience, and put a reverse proxy with size limits in front of public MCP endpoints. Avoid passing API keys as custom headers to MCP servers you do not control.
Sources for this story
- MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length (opens in a new tab)Official
Model Context Protocol on GitHub · github.com
- MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (opens in a new tab)Official
Model Context Protocol on GitHub · github.com
- Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (opens in a new tab)Official
Model Context Protocol on GitHub · github.com
- Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (opens in a new tab)Official
Model Context Protocol on GitHub · github.com
- Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (opens in a new tab)Official
Model Context Protocol on GitHub · github.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #mcp
- #sdk
- #denial-of-service
- #oauth