Tools AI Risk Radar ai-incident-0242
Incident record
MCP HTTP servers accepted oversized bodies and batches
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- modelcontextprotocol/typescript-sdk
- Actor
- researcher
What happened
Unbounded request bodies and long JSON-RPC batches could consume memory or stop a server handling other clients.
The maintainer lists fixes in SDK 1.30.1, server and node 2.1.0, and hono 2.0.1. All installed affected packages need updating. The default fixed limits are 4 MiB per body and 100 messages per batch; stdio-only servers use a different transport.
Sources
- Maintainer security advisorygithub.com/modelcontextprotocol/typescript-sdk/security/advi…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026