---
id: CVE-2026-0621
title: >-
  Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a
  regular expression denial of service (ReDoS) vulnerability in the UriTemplate
  class when processing RFC 6570 exploded array patterns
summary: >-
  Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a
  regular expression denial of service (ReDoS) vulnerability in the UriTemplate
  class when processing RFC 6570 exploded array patterns. The dynamically
  generated …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1333
vendor: lfprojects
product: mcp_typescript_sdk
affected:
  - mcp_typescript_sdk <= 1.25.1
published: '2026-01-05'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0621'
references:
  - url: 'https://github.com/modelcontextprotocol/typescript-sdk/issues/965'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos
    label: disclosure@vulncheck.com
  - url: 'https://github.com/modelcontextprotocol/typescript-sdk/issues/965'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00445
epssPercentile: 0.38096
ingestedAt: '2026-07-15T13:44:03.732Z'
---

## Overview

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.

## Affected

- `mcp_typescript_sdk <= 1.25.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.