CVE-2026-111768: High severity npm/@modelcontextprotocol/server vulnerability
Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory.
No credentials are needed, unless you authenticate requests before they reach the SDK.
Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for McpServer tools whose input contains an array or a record. stdio-only servers are not affected.
Affected versions:
- @modelcontextprotocol/sdk 1.3.0 through 1.31.0 - @modelcontextprotocol/server 2.0.0 through 2.2.0
Fix Upgrade to:
- 1.x: @modelcontextprotocol/sdk 1.32.0 or later - 2.x: @modelcontextprotocol/server 2.3.0 or later
Upgrading alone changes nothing. The patched versions add an McpServer option, maxToolInputElements, that is off by default. Make both of these changes:
1. Set maxToolInputElements just above the largest input your tools need, for example new McpServer(info, { maxToolInputElements: 10000 }). It counts array elements and object keys in a call's arguments. A call over the limit gets an isError: true result. 2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set maxRequestBodySize on the transport or createMcpHandler(). If you parse the body yourself, for example with express.json() or Fastify, set that parser's limit.
If you cannot upgrade yet, make the second change. maxRequestBodySize needs @modelcontextprotocol/sdk 1.30.1 or @modelcontextprotocol/server 2.1.0. Below that, use a reverse proxy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@modelcontextprotocol/serverto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
npm/@modelcontextprotocol/sdkto a version that resolves this vulnerability.Fixed in 1.32.0 - Upgrade
Upgrade
@modelcontextprotocol/sdkto a version that resolves this vulnerability.Fixed in 1.32.0 - Upgrade
Upgrade
@modelcontextprotocol/serverto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Set maxToolInputElements just above the largest tool input required, for example new McpServer(info, { maxToolInputElements: 10_000 }).
McpServer maxToolInputElements = 10_000 - Configuration
Set maxRequestBodySize on the transport or createMcpHandler(); if parsing the body yourself with express.json() or Fastify, set the parser's request-size limit as well.
MCP HTTP transport or createMcpHandler() maxRequestBodySize = Lower than the default 4 MiB and appropriate for the tools' needs
Event History
Frequently Asked Questions
Which deployments are exposed?
Servers reachable over HTTP by clients you do not fully trust are affected. Risk is highest for McpServer tools that accept an array or record as input; stdio-only servers are not affected.
Does an attacker need credentials or user interaction?
No credentials or user interaction are required when the attacker can reach the server over HTTP. Credentials are needed only if requests are authenticated before reaching the SDK.
Will upgrading automatically enable protection?
No. The patched versions add the McpServer maxToolInputElements option, but it is disabled by default, so upgrading alone does not change the behavior.
What configuration change is required after upgrading?
Set maxToolInputElements to a value just above the largest input your tools require, such as new McpServer(info, { maxToolInputElements: 10_000 }). The limit counts both array elements and object keys in a call's arguments.
Which package versions need remediation?
Affected versions are @modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0. Upgrade the SDK to 1.32.0 or later, or the server package to 2.3.0 or later, and configure the input-element limit.