The Model Context Protocol TypeScript SDK allowed servers to validate HTTP requests containing arrays or object keys without imposing limits on the number of elements or keys. A single request within the default 4 MiB payload size can force the JavaScript heap to exhaust, terminating the server process. The vulnerability does not require special credentials unless the application authenticates before SDK processing; an unauthenticated HTTP request is sufficient to trigger the failure. The memory exhaustion is the defining impact, resulting in a denial‑of‑service of the affected service.

Affected products include the Model Context Protocol SDK for JavaScript from versions 1.3.0 through 1.32.0, the Model Context Protocol Server from versions 2.0.0 through 2.3.0, and the TypeScript SDK interface used by developers. These versions lack validation bounds on array elements and object keys, enabling large workloads within the normal request size limit.

The CVSS score of 7.5 classifies this as a high‑severity vulnerability, and although an EPSS score is not provided, the lack of mitigation until configuration changes implies a real risk of exploitation. The issue is not listed in the CISA KEV catalog, but attackers could abuse public HTTP endpoints to send crafted large arrays or objects, potentially exhausting server memory and causing availability outages. The vulnerability can be leveraged remotely via standard HTTP requests, making it broadly exploitable in any exposed service that uses the SDK without additional bounds.