@modelcontextprotocol/node has 1 advisory. Version not read yet.

npm ↗

Versions

Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.

2.x
safe 2.1.0
AffectedSafe

Details

You run
not in lockfile
Safe
2.1.0
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(1)

HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

@modelcontextprotocol/sdk · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.10.0 through 1.30.0, or @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0, or @modelcontextprotocol/hono 2.0.0.
  • MCP server is exposed over Streamable HTTP (not stdio-only).
  • Clients that are not fully trusted can reach the server's HTTP endpoint.
  • Requests are not authenticated by the application before reaching the SDK.
Affected
@modelcontextprotocol/sdk >=1.10.0 <1.30.1 · @modelcontextprotocol/server >=2.0.0 <2.1.0 · @modelcontextprotocol/node >=2.0.0 <2.1.0 · @modelcontextprotocol/hono >=2.0.0 <2.0.1
Fixed in
1.30.1 · 2.1.0 · 2.0.1
ID
GHSA-f897-62hf-6gxq
Open the alert