MCP TypeScript SDK lacks request body size and batch length limits

# MCP TypeScript SDK lacks request body size and batch length limits

https://gcdradar.vercel.app/incidents/mcp-typescript-sdk-lacks-request-body-size-and-batch-length · AIR-2026-1585 · closed 2026-10-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with no confirmed exploitation.
- Fix status: Fix status unknown
- First reported: 2026-10-27
- AI role: Attack on AI
- Products: MCP TypeScript SDK
- CVSS: 7.5

## Summary

HTTP server transports in the MCP TypeScript SDK fail to limit POST body sizes or JSON-RPC batch lengths. Unauthenticated clients can cause memory exhaustion and block server availability with large or lengthy requests.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: @modelcontextprotocol/sdk >= 1.10.0, < 1.30.1
- Affected: @modelcontextprotocol/server >= 2.0.0, < 2.1.0
- Affected: @modelcontextprotocol/node >= 2.0.0, < 2.1.0
- Affected: @modelcontextprotocol/hono >= 2.0.0, < 2.0.1
- Fixed in: @modelcontextprotocol/sdk 1.30.1
- Fixed in: @modelcontextprotocol/server 2.1.0
- Fixed in: @modelcontextprotocol/node 2.1.0
- Fixed in: @modelcontextprotocol/hono 2.0.1

## Latest updates

- 2026-10-27: GHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length (https://github.com/advisories/GHSA-f897-62hf-6gxq)

## Sources

- 2026-10-27 GitHub Advisory Database: GHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length https://github.com/advisories/GHSA-f897-62hf-6gxq

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.