CVE-2026-111768: 
JavaScript vulnerability analysis and mitigation

CVE-2026-111768 is a resource exhaustion vulnerability in the Model Context Protocol (MCP) TypeScript SDK that allows unauthenticated attackers to exhaust server memory with a single HTTP request. Affected packages are @modelcontextprotocol/sdk versions 1.3.0 through 1.31.0 and @modelcontextprotocol/server versions 2.0.0 through 2.2.0. The vulnerability was published on October 15, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): affected server versions impose no limit on the number of array elements or object keys validated within a single request. An attacker can craft a single HTTP request within the default 4 MiB body size limit that contains deeply nested or large arrays/objects, causing the Zod-based input validation to allocate unbounded memory and ultimately crash the Node.js process with a JavaScript heap out-of-memory error. The attack requires no authentication unless the application explicitly authenticates requests before they reach the SDK, and is only applicable to servers exposed over HTTP — stdio-only servers are not affected (GitHub Advisory).

Successful exploitation causes the MCP server process to abort due to JavaScript heap exhaustion, resulting in a complete denial of service for all clients relying on that server. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. The risk is highest for McpServer tool handlers whose input schemas accept arrays or record (object) types, as these allow the largest unbounded allocations during validation (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires no credentials or user interaction and is remotely exploitable over the network with low attack complexity, making it trivially weaponizable against any exposed HTTP-based MCP server running an affected version. No EPSS score or CISA KEV catalog entry is currently available for this CVE (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible MCP servers running @modelcontextprotocol/sdk 1.3.0–1.31.0 or @modelcontextprotocol/server 2.0.0–2.2.0 over HTTP.
2. Identify target tool: Determine which MCP tool endpoints accept array or record/object input parameters, as these are the most vulnerable to validation exhaustion.
3. Craft malicious payload: Construct a JSON request body within the default 4 MiB size limit that contains a deeply nested or very large array/object structure (e.g., an array with tens of thousands of elements, or an object with tens of thousands of keys).
4. Send the request: Submit the crafted HTTP POST request to the MCP server's tool invocation endpoint without any authentication headers (unless the application enforces auth before the SDK layer).
5. Trigger memory exhaustion: The server's input validation iterates over all array elements or object keys without limit, causing unbounded memory allocation and crashing the Node.js process with a heap out-of-memory error, resulting in denial of service (GitHub Advisory).

• Logs: Node.js process logs showing FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory or similar V8 heap exhaustion messages; application crash/restart events in process manager logs (e.g., PM2, systemd).
• Network: Repeated or single large HTTP POST requests to MCP tool endpoints with unusually large JSON bodies (approaching 4 MiB) containing deeply nested arrays or objects.
• Process: Sudden termination of the MCP server Node.js process followed by automatic restarts; elevated memory consumption visible in system monitoring tools (e.g., top, htop) immediately before crash.

Upgrade to @modelcontextprotocol/sdk 1.32.0 or later (1.x branch) or @modelcontextprotocol/server 2.3.0 or later (2.x branch). After upgrading, configure the new maxToolInputElements option on McpServer (e.g., new McpServer(info, { maxToolInputElements: 10_000 })) and lower the request body size limit via maxRequestBodySize on the transport or createMcpHandler(). If an immediate upgrade is not possible, set maxRequestBodySize (available since SDK 1.30.1 / server 2.1.0) or place a reverse proxy in front of the server to enforce body size limits (GitHub Advisory).