CVE-2026-58483: 
JavaScript vulnerability analysis and mitigation

CVE-2026-58483 is an Uncontrolled Resource Consumption (DoS) vulnerability in the SearXNG MCP Server (mcp-searxng) npm package, specifically in the web_url_read tool. The flaw allows an unauthenticated, network-reachable attacker to bypass the configured 5 MiB response-size limit by serving HTTP responses without a Content-Length header, causing the server to load arbitrarily large response bodies into memory. All versions up to and including 1.6.0 are affected; version 1.7.1 contains the fix. It carries a CVSS v3.1 score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption) in src/url-reader.ts. The web_url_read tool enforces its 5 MiB size limit solely by inspecting the Content-Length header from a preliminary HEAD request via checkContentLength(). When the server omits Content-Length — a perfectly valid HTTP practice — checkContentLength() returns null, and the guard condition if (contentLength !== null && contentLength > maxContentLengthBytes) evaluates to false, bypassing the check entirely. Execution then falls through to response.text() at line 414 (and line 402 for error paths), which reads the entire response body into memory with no byte cap; the resulting HTML string is subsequently passed to NodeHtmlMarkdown.translate(), amplifying CPU consumption proportional to body size. In HTTP transport mode (the default), authentication is disabled, making the attack vector fully unauthenticated and network-accessible; in stdio mode, the attack surface is reachable via prompt injection (GitHub Advisory).

Successful exploitation causes the mcp-searxng process to allocate memory proportional to an arbitrarily large HTTP response body and burn CPU during HTML-to-Markdown conversion, resulting in a Denial of Service. Repeated or concurrent invocations can exhaust process memory and render the MCP server completely unavailable to all legitimate users. There is no confidentiality or integrity impact; the attack is purely an availability concern (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory, demonstrating that a 6 MiB response body is successfully transmitted to mcp-searxng despite the 5 MiB limit, confirming the bypass. The attack requires no authentication in the default HTTP transport configuration and no user interaction, making it trivially exploitable by any network-reachable attacker. No in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV listing has been reported at this time (GitHub Advisory).

1. Identify target: Locate an internet-facing or network-accessible mcp-searxng instance running in HTTP transport mode (default configuration, versions ≤ 1.6.0).
2. Set up malicious HTTP server: Deploy an HTTP server that responds to HEAD requests with HTTP 200 and a Content-Type header but deliberately omits the Content-Length header, triggering checkContentLength() to return null.
3. Serve oversized GET response: Configure the malicious server to respond to GET requests with an HTML body exceeding 5 MiB (e.g., 6+ MiB) and again omit the Content-Length header.
4. Initialize MCP session: Send a JSON-RPC initialize request to the MCP HTTP endpoint (e.g., http://<target>/mcp) to establish a session.
5. Invoke web_url_read with attacker-controlled URL: Send a tools/call JSON-RPC request targeting the web_url_read tool with the malicious server's URL as the argument: {"method": "tools/call", "params": {"name": "web_url_read", "arguments": {"url": "http://<evil-server>/"}}}.
6. Trigger unbounded read: The size-limit guard is bypassed (null !== null => false), and response.text() reads the entire oversized body into memory; NodeHtmlMarkdown.translate() then processes it, consuming additional CPU.
7. Repeat for amplified DoS: Send concurrent or repeated requests to exhaust process memory and render the MCP server unavailable (GitHub Advisory).

• Network: Unusually large HTTP GET responses (>5 MiB) fetched by the mcp-searxng process from external or unexpected hosts; repeated outbound HEAD+GET request pairs to the same host in rapid succession.
• Process: Sustained high memory usage or memory growth in the Node.js process running mcp-searxng; elevated CPU utilization consistent with large HTML-to-Markdown conversion workloads.
• Logs: MCP server access logs showing repeated tools/call requests for web_url_read with the same or rotating attacker-controlled URLs; absence of Content-Too-Large error responses despite large fetched content.
• Application: mcp-searxng process crashes or OOM-killer events in system logs (e.g., /var/log/syslog or dmesg) attributable to the Node.js process (GitHub Advisory).

Upgrade mcp-searxng to version 1.7.1 or later, which replaces the unbounded response.text() calls with a streaming reader that aborts once the byte counter exceeds maxContentLengthBytes. No configuration-based workaround fully mitigates the issue in versions ≤ 1.6.0; however, operators can reduce exposure by enabling authentication on the HTTP transport and restricting network access to the MCP server endpoint. If upgrading is not immediately possible, disabling the web_url_read tool or running mcp-searxng in a resource-constrained container (e.g., with memory limits) can limit the blast radius (GitHub Advisory).