Key points
- CVE-2026-111768 allows HTTP requests to exhaust server memory in affected MCP packages.
- Patched versions require manual configuration of maxToolInputElements to be effective.
- Untrusted clients reaching servers over HTTP face the highest risk of disruption.
Teams using the Model Context Protocol must upgrade their npm packages immediately to address a high-severity vulnerability. The flaw, identified as CVE-2026-111768, affects @modelcontextprotocol/sdk versions 1.3.0 through 1.31.0 and @modelcontextprotocol/server versions 2.0.0 through 2.2.0. According to GitHub advisory GHSA-46jr-4wx8-v453, these packages lack limits on array elements and object keys validated in single requests.
In plain English
The issue arises because servers process incoming data without checking how large the structures are. A single HTTP request, even within the default four-megabyte size limit, can contain enough nested data to consume all available memory. This causes the server process to abort with a JavaScript heap out of memory error. No credentials are required to trigger this, unless additional authentication layers sit before the SDK.
The background
The risk is highest for McpServer tools that accept arrays or records as input. Servers communicating solely via standard input and output are not affected by this specific flaw. Attackers do not need to authenticate if the server accepts requests directly. The vulnerability exists in the validation logic that processes tool arguments before execution.
What changes now
Vendors have released patched versions: 1.32.0 for the SDK and 2.3.0 for the server. However, upgrading alone does not fix the issue. The new versions introduce a maxToolInputElements option that is disabled by default. Administrators must set this value to a number slightly above their largest expected input. They must also lower request size limits to match tool requirements.
Who needs to act first
Teams should prioritize updating systems exposed to untrusted internet traffic before addressing internal-only services. Verify that all instances of the affected packages are upgraded to the patched versions. After upgrading, configure the new input limits in your application code to ensure the protection is active. Test the changes in a staging environment to confirm that legitimate tool inputs still function correctly while oversized requests are rejected.
What to do and how to stay safe: CVE-2026-111768
- Upgrade @modelcontextprotocol/sdk to 1.32.0 or later and @modelcontextprotocol/server to 2.3.0 or later.
- Configure the maxToolInputElements option in your McpServer initialization to limit array and object key counts.
- Reduce the HTTP request body size limit using transport settings or middleware parsers to match your tool needs.
- If you cannot upgrade immediately, lower request size limits using version 1.30.1 or 2.1.0, or deploy a reverse proxy with size restrictions.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does simply upgrading the package fix the vulnerability?
No, upgrading alone changes nothing because the new protective option is off by default and must be manually configured.
Are standard input and output servers affected by this flaw?
No, stdio-only servers are not affected; the risk applies to servers reachable over HTTP with untrusted clients.
What happens if a request exceeds the configured input limits?
The call returns an isError: true result, preventing the server from processing the excessive data and crashing.
