Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 27 October 2026.

Which products and versions are affected?

Model Context Protocol Hono 2.0.0; Model Context Protocol Node 2.0.0; Model Context Protocol Sdk 1.10.0 through 1.30.0; Model Context Protocol Server 2.0.0; and 4 more.

Is there a fix for This vulnerability?

Yes. @modelcontextprotocol/hono (npm): upgrade to 2.0.1 or later; @modelcontextprotocol/node (npm): upgrade to 2.1.0 or later; @modelcontextprotocol/sdk (npm): upgrade to 1.30.1 or later; @modelcontextprotocol/server (npm): upgrade to 2.1.0 or later. Until then: If unable to upgrade immediately, cap request body size in a reverse proxy or load balancer in front of the MCP server. [ {"kind": "disclosed", "at": "2026-10-27"} ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Model Context Protocol Hono, Model Context Protocol Node, Model Context Protocol Sdk or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

MCP TypeScript SDK denial of service via unbounded request body and JSON-RPC batch

Severity: high · CVSS 7.5 · Published 2026-10-27

The Model Context Protocol TypeScript SDK failed to limit the size of HTTP POST bodies or the number of messages in JSON-RPC batches on HTTP-connected servers. An unauthenticated attacker can send extremely large requests to exhaust server memory or send massive batches to block the server from responding to legitimate clients, causing service outages.

Technologies: @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm). Vendors: Model Context Protocol, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 27 October 2026.
Which products and versions are affected?: Model Context Protocol Hono 2.0.0; Model Context Protocol Node 2.0.0; Model Context Protocol Sdk 1.10.0 through 1.30.0; Model Context Protocol Server 2.0.0; and 4 more.
Is there a fix for This vulnerability?: Yes. @modelcontextprotocol/hono (npm): upgrade to 2.0.1 or later; @modelcontextprotocol/node (npm): upgrade to 2.1.0 or later; @modelcontextprotocol/sdk (npm): upgrade to 1.30.1 or later; @modelcontextprotocol/server (npm): upgrade to 2.1.0 or later. Until then: If unable to upgrade immediately, cap request body size in a reverse proxy or load balancer in front of the MCP server.</anigation> <parameter name="timeline">[ {"kind": "disclosed", "at": "2026-10-27"} ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Model Context Protocol Hono, Model Context Protocol Node, Model Context Protocol Sdk or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@modelcontextprotocol/hono (npm): upgrade to 2.0.1 or later
```
npm install @modelcontextprotocol/hono@2.0.1
```
@modelcontextprotocol/node (npm): upgrade to 2.1.0 or later
```
npm install @modelcontextprotocol/node@2.1.0
```
@modelcontextprotocol/sdk (npm): upgrade to 1.30.1 or later
```
npm install @modelcontextprotocol/sdk@1.30.1
```
@modelcontextprotocol/server (npm): upgrade to 2.1.0 or later
```
npm install @modelcontextprotocol/server@2.1.0
```

If unable to upgrade immediately, cap request body size in a reverse proxy or load balancer in front of the MCP server.</anigation> <parameter name="timeline">[ {"kind": "disclosed", "at": "2026-10-27"} ]

Technical details

HTTP server transports in MCP did not enforce limits on POST body size or JSON-RPC batch message count, allowing unbounded memory allocation. Attackers over the network with no credentials required can trigger denial of service by sending oversized requests or batches; the vulnerability affects only HTTP transports and not stdio-based servers. Fixes impose a 4 MiB body limit and 100-message batch limit by default.

Affected products

Model Context Protocol sdk 1.10.0 through 1.30.0
Model Context Protocol server 2.0.0
Model Context Protocol node 2.0.0
Model Context Protocol hono 2.0.0

References

https://api.github.com/users/cybercraftsolutionsllc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.