MCP TypeScript SDK: a single HTTP request can exhaust server memory, fixed version released
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
A GitHub security advisory discloses that versions of @modelcontextprotocol/sdk before 1.32.0 and versions of @modelcontextprotocol/server before 2.3.0 do not limit the number of array elements and object keys when validating requests; a single HTTP request within the default 4 MiB size limit can exhaust server memory, and the process aborts with JavaScript heap out of memory, with no credentials required unless the request is authenticated before reaching the SDK. stdio-only servers are not affected; the highest risk is McpServer tools whose input contains arrays or records. The fixed versions add an McpServer option maxToolInputElements that is off by default and must be manually set to a value slightly higher than the tool's maximum input; calls exceeding the limit return isError: true; it is also recommended to lower maxRequestBodySize to the size the tool actually needs.
The advisory gives the affected and fixed versions, and states that upgrading alone is not enough; maxToolInputElements and a request body size limit must also be set.