Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-0621

CVE-2026-0621HIGH

Anthropic MCP TypeScript SDK — MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0044   36.7     —

AFFECTED
  Product             Versions     Fixed
  MCP TypeScript SDK  unspecified  —

TIMELINE
  Jan 5   Reserved by VulnCheck
  Jan 5   Published (CNA: VulnCheck)
  Oct 8   EXPLOIT PUBLISHED — CVE-2026-0621 (Anthropic MCP TypeScript SDK). Public exploit reference added.

CWE-1333 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

Description

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 5, 2026	Reserved	Reserved by VulnCheck
January 5, 2026	Published	Published (CNA: VulnCheck)
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-0621 (Anthropic MCP TypeScript SDK). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Anthropic	MCP TypeScript SDK	—	—	—

Weaknesses

CWE-1333

References (2)

https://github.com/modelcontextprotocol/typescript-sdk/issues/965 [Exploit, Issue Tracking]
https://www.vulncheck.com/advisories/mcp-typescript-sdk-uritemplate-exploded-array-pattern-redos [Third Party Advisory]

Authoritative record: CVE-2026-0621 at cve.org

Vendors: anthropic

Weaknesses: CWE-1333

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-0621 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Tuesday, October 20, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.