Inefficient regular expression complexity in typescript-sdk - CVE-2026-0621
Published: November 9, 2026
Vulnerability identifier: #VU163209
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-0621
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to deny service to all clients of affected MCP servers.
The vulnerability exists due to catastrophic regular expression backtracking in the TypeScript SDK's UriTemplate class when matching crafted URIs against registered resource templates with exploded array patterns. An unauthenticated remote attacker can send a crafted URI through a resources/read request to exhaust CPU resources and hang or crash the server.
Affected software
typescript-sdk
How to mitigate CVE-2026-0621
Install security update from vendor's website.
typescript-sdk - update to 1.25.2