CVE-2026-0621

HighCVSS 7.5

Published: 05/01/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A ReDoS vulnerability in Anthropic's MCP TypeScript SDK up to version 1.25.1 exists in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on specially crafted inputs, leading to excessive CPU consumption.

Risk Assessment

An attacker can supply a malicious URI that causes the Node.js process to become unresponsive, resulting in a denial of service (DoS) and potential disruption of application availability.

Recommendation

Immediately update the MCP TypeScript SDK to a version later than 1.25.1, which includes a fix for the ReDoS vulnerability.

Other vulnerabilities in MCP TypeScript SDK

CVE-2026-25536High
A vulnerability in the MCP TypeScript SDK allows cross-client response data leak when a single server and transport instance is reused across multiple client connections. The issue affects versions 1.10.0 through 1.25.3, most notably in stateless StreamableHTTPServerTransport deployments.

Original NVD description (English source)

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.