CVE-2026-0621

Katalog CVE

CVSS 7.5 · High EPSS 0,44%

Kerentanan Inefficient Regular Expression Complexity pada lfprojects mcp typescript sdk. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.

Rincian

Terbit di NVD

5 Januari 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos advisory pihak ketiga
• https://github.com/modelcontextprotocol/typescript-sdk/issues/965 exploit · issue tracking