CVE-2026-0621: 
Wolfi vulnerability analysis and mitigation

CVE-2026-0621 is a Regular Expression Denial of Service (ReDoS) vulnerability in Anthropic's MCP TypeScript SDK (@modelcontextprotocol/sdk) affecting all versions up to and including 1.25.1. The flaw resides in the UriTemplate class's partToRegExp() function, which generates a regex with nested quantifiers when processing RFC 6570 exploded array patterns (e.g., {/id*}, {?tags*}), enabling catastrophic backtracking on crafted inputs. It was disclosed on January 5, 2026, with a patch released in version 1.25.2. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable pattern ([^/]+(?:,[^/]+)*) is dynamically generated in uriTemplate.ts (function partToRegExp(), lines 223–271) for exploded template variables. The outer [^/]+ and the inner (?:,[^/]+)* group create nested quantifiers: when a crafted URI containing many comma-separated segments followed by a non-matching character is evaluated, the regex engine must explore an exponential number of backtracking paths, consuming 100% CPU. The attack surface is the ReadResourceRequestSchema handler in mcp.ts, where the URI is attacker-controlled and passed directly to uriTemplate.match(). A public proof-of-concept demonstrating the issue is available in the GitHub issue tracker (GitHub Issue #965, GitHub Advisory).

Successful exploitation causes the Node.js event loop to block entirely, resulting in 100% CPU utilization and rendering the MCP server unresponsive to all connected clients — a complete denial of service. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Any MCP server that registers resource templates using exploded array patterns and accepts requests from untrusted clients is at risk, including web applications, API servers, and AI agent infrastructure built on the SDK (GitHub Issue #965, GitHub Advisory).

A public proof-of-concept is available in the GitHub issue tracker, demonstrating that a malicious URI with 10 repeated comma-separated segments causes ~58 seconds of processing time, and 50 repeats results in an infinite loop and server crash. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable over the network. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042%, indicating a low but non-zero probability of exploitation in the near term (GitHub Issue #965, Feedly).

1. Identify a vulnerable target: Locate an MCP server running @modelcontextprotocol/sdk version ≤1.25.1 that exposes a resources/read endpoint and registers resource templates using RFC 6570 exploded array patterns (e.g., file:///users{/id*}/files{/path*}).
2. Craft a malicious URI: Construct a URI matching the registered template's prefix but containing a long sequence of comma-separated segments followed by a non-matching suffix to force catastrophic backtracking. Example: file:///users/user1,user2,user3,...,user20,FAIL/files/path1,path2,path3FAIL/
3. Send the resources/read request: Submit the crafted URI via the MCP protocol's resources/read request to the target server. No authentication is required if the server accepts requests from untrusted clients.
4. Trigger ReDoS: The server's uriTemplate.match() call evaluates the malicious URI against the vulnerable regex ([^/]+(?:,[^/]+)*), causing exponential backtracking and 100% CPU consumption.
5. Achieve denial of service: The Node.js event loop becomes blocked, making the server unresponsive to all clients until the process is restarted (GitHub Issue #965, GitHub Advisory).

• Network: Unusual or repeated resources/read MCP protocol requests containing URIs with long comma-separated path segments (e.g., user1,user2,...,userN,FAIL) targeting endpoints registered with exploded patterns.
• Process: Node.js process consuming sustained 100% CPU on the MCP server host; server process becoming unresponsive or timing out.
• Logs: MCP server access logs showing resources/read requests with abnormally long URI strings containing repeated comma-delimited segments; absence of response logs following such requests (indicating a hang).
• System: Increased load average on the server host; watchdog or health-check alerts firing due to server unresponsiveness (GitHub Issue #965).

Upgrade @modelcontextprotocol/sdk to version 1.25.2 or later, which contains commit b392f02 that modifies the regex pattern to eliminate nested quantifiers and prevent catastrophic backtracking (GitHub Advisory). If immediate patching is not possible, apply the following workarounds: (1) avoid registering resource templates that use exploded array patterns ({/id*}, {?tags*}, etc.); (2) implement request timeouts and rate limiting on the MCP server; (3) validate and reject URIs with suspicious patterns (e.g., excessively long comma-separated segments) before passing them to uriTemplate.match(); (4) restrict access to the MCP server to trusted networks or authenticated clients only (GitHub Advisory, VulnCheck).

The vulnerability was reported by researcher weblover12 via the GitHub issue tracker on September 24, 2025, and formally disclosed on January 5, 2026. Community discussion on dev.to and ZeroDay Forem highlighted the broader concern of the MCP SDK becoming an expanding attack surface, with articles noting that this is one of several CVEs affecting the MCP ecosystem. The Serverless Framework also released an update (sf-core@4.30.0) that addressed this dependency. Red Hat tracked the issue and IBM App Connect Enterprise was noted in security coverage as an affected downstream product (GitHub Issue #965, Dev.to).