Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of
    service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns.
    The dynamically generated regular expression used during URI matching contains nested quantifiers that can
    trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An
    attacker can exploit this by supplying a malicious URI that causes the Node.js process to become
    unresponsive, leading to a denial of service. (CVE-2026-0621)

ID	Name	Product	Family	Type	Severity
464444	Echo: @modelcontextprotocol/sdk: security update to 1.25.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
464444	Echo: @modelcontextprotocol/sdk: security update to 1.25.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
436602	SCA: security update for @modelcontextprotocol/sdk (GHSA-8r9q-7v3j-jr4g)	Tenable Cloud Security	SCA Checks	Local	high
436602	SCA: security update for @modelcontextprotocol/sdk (GHSA-8r9q-7v3j-jr4g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-0621

high

Tenable Plugins

high

high

high

high