CVE-2026-111768 and three more: MCP TypeScript SDK before 1.32.0 lets one request exhaust server memory, leaks experimental tasks across sessions, accepts other services' tokens and leaks secrets on cross-origin redirects

What it is

CVE-2026-111768 (GHSA-46jr-4wx8-v453, high, CVSS 7.5): servers put no limit on how many array elements and object keys they validate in one request, so one request within the default 4 MiB body limit can exhaust memory and abort the process. No credentials are needed unless you authenticate before the SDK. Affects @modelcontextprotocol/sdk 1.3.0 to 1.31.0 and @modelcontextprotocol/server 2.0.0 to 2.2.0; stdio-only servers are not affected. The fix adds a maxToolInputElements option that is off by default.

CVE-2026-111767 (GHSA-22jm-h49p-29qw, high, CVSS 8.6): the experimental tasks feature did not check which session created a task, so clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Affects @modelcontextprotocol/sdk 1.24.0 to 1.31.0 when an HTTP server passes taskStore to McpServer or Server; 2.x is not affected. Experimental tasks are deprecated.

CVE-2026-111771 (GHSA-rvq5-wwqv-78pq, medium): requireBearerAuth() and verifyBearerToken() had no way to check a token's audience, so where one authorization server issues tokens for several services, a token for another service was accepted by your MCP server. The fix adds an expectedResource setting that is off by default.

CVE-2026-111769 (GHSA-6prh-2h8m-c8cw, medium): StreamableHTTPClientTransport, SSEClientTransport and the SDK's OAuth client functions followed redirects to any origin, sending custom headers such as X-API-Key and mcp-session-id, and on 307/308 the request body, including OAuth refresh_token and client_secret.

How to check

1. Run npm ls @modelcontextprotocol/sdk @modelcontextprotocol/server @modelcontextprotocol/client; sdk below 1.32.0 or server/client below 2.3.0 is affected.
2. Run grep -ri taskstore --exclude-dir=node_modules . to see whether you use experimental tasks.
3. Check whether your MCP server is reachable over HTTP by clients you don't fully trust, and whether it uses requireBearerAuth() with an authorization server shared by other services.

How to fix

1. Upgrade @modelcontextprotocol/sdk to 1.32.0 or later, or @modelcontextprotocol/server and @modelcontextprotocol/client to 2.3.0 or later (plus @modelcontextprotocol/express 2.0.2 and @modelcontextprotocol/server-legacy 2.3.1 if you use them).
2. Then turn the new protections on: set maxToolInputElements on McpServer just above what your tools need and lower maxRequestBodySize; pass expectedResource to requireBearerAuth() and return the token's audience as AuthInfo.resource from verifyAccessToken().
3. Stop using experimental tasks, or use one InMemoryTaskStore per session.
4. If a client redirect may have reached a host you don't control, rotate the API keys and client_secret your app held and revoke its tokens.

npm ls @modelcontextprotocol/sdk @modelcontextprotocol/server @modelcontextprotocol/client
npm install @modelcontextprotocol/sdk@^1.32.0

Sources

• GitHub advisory GHSA-46jr-4wx8-v453: one HTTP request could exhaust server memory during validation ↗
• GitHub advisory GHSA-22jm-h49p-29qw: experimental tasks were not tied to the session that created them ↗
• GitHub advisory GHSA-rvq5-wwqv-78pq: bearer authentication accepted tokens issued for another service ↗
• GitHub advisory GHSA-6prh-2h8m-c8cw: HTTP client transports followed cross-origin redirects ↗
• NVD: CVE-2026-111768 ↗