[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRfjUz4n-9MupF5JxGj3HkW2ah-uYUKgZSjrsBR7z8tQ":3,"g5a-risk:CVE-2026-0621":122},{"success":4,"data":5,"meta":119},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":28,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":49,"references":50,"referencesCount":64,"weaknesses":65,"weaknessesCount":49,"isActivelyExploited":74,"cisaInfo":28,"otxData":28,"relatedBlogPosts":75,"seoMetadata":76,"configurations":101,"relatedVendorCves":110,"notableEvents":111},"CVE-2026-0621","What is CVE-2026-0621?","Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.js process to become unresponsive, leading to a denial of service.","Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate cl...","2026-01-05T21:16:14.533","2026-10-08T16:16:55.48",8.7,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"CVSSMetricV31":15,"CVSSMetricV30":31,"CVSSMetricV2":32,"CVSSMetricV40":33},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":24,"AvailabilityImpact":26,"BaseScore":27,"BaseSeverity":26,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H","NETWORK","LOW","NONE","UNCHANGED","HIGH",7.5,null,3.9,3.6,[],[],[34],{"Source":35,"Type":36,"CVSSData":37},"disclosure@vulncheck.com","Secondary",{"Version":38,"VectorString":13,"BaseScore":12,"BaseSeverity":26,"AttackVector":22,"AttackComplexity":23,"AttackRequirements":24,"PrivilegesRequired":24,"UserInteraction":24,"VulnConfidentialityImpact":24,"VulnIntegrityImpact":24,"VulnAvailabilityImpact":26,"SubConfidentialityImpact":24,"SubIntegrityImpact":24,"SubAvailabilityImpact":24,"ExploitMaturity":39,"ConfidentialityRequirement":39,"IntegrityRequirement":39,"AvailabilityRequirement":39,"ModifiedAttackVector":39,"ModifiedAttackComplexity":39,"ModifiedAttackRequirements":39,"ModifiedPrivilegesRequired":39,"ModifiedUserInteraction":39,"ModifiedVulnConfidentialityImpact":39,"ModifiedVulnIntegrityImpact":39,"ModifiedVulnAvailabilityImpact":39,"ModifiedSubConfidentialityImpact":39,"ModifiedSubIntegrityImpact":39,"ModifiedSubAvailabilityImpact":39,"Safety":39,"Automatable":39,"Recovery":39,"ValueDensity":39,"VulnerabilityResponseEffort":39,"ProviderUrgency":39},"4.0","NOT_DEFINED",0.00438,[40,40,40,40,40,40,40],"High",[44],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"lfprojects","mcp_typescript_sdk","*","cpe:2.3:a:lfprojects:mcp_typescript_sdk:*:*:*:*:*:*:*:*",1,[51,57,62],{"url":52,"source":53,"tags":54},"https:\u002F\u002Fgithub.com\u002Fmodelcontextprotocol\u002Ftypescript-sdk\u002Fissues\u002F965","GitHub",[55,56],"Exploit","Issue Tracking",{"url":58,"source":59,"tags":60},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fmcp-typescript-sdk-uritemplate-exploded-array-pattern-redos","Vulncheck",[61],"Third Party Advisory",{"url":52,"source":53,"tags":63},[55,56],3,[66],{"id":67,"name":68,"description":69,"extendedDescription":70,"status":71,"abstraction":72,"structure":73},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.","Some regular expression engines have a feature called \"backtracking\". If the token cannot match, the engine \"backtracks\" to a position that may result in a different token that can match.\n                Backtracking becomes a weakness if all of these conditions are met:","Draft","Base","Simple",false,[],{"title":77,"metaDescription":78,"keywords":79,"canonicalUrl":80,"structuredData":81},"What is CVE-2026-0621? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-0621, a high severity cyber security vulnerability from 2026. Anthropic's MCP TypeScript SDK versions up to and including ...","CVE-2026-0621, CVE-2026-0621 vulnerability, CVE-2026-0621 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, lfprojects security, mcp_typescript_sdk vulnerability","\u002Fwhat-is\u002Fcve-2026-0621",{"@context":82,"@type":83,"headline":77,"description":78,"datePublished":10,"dateModified":11,"author":84,"publisher":88,"about":92,"mainEntityOfPage":96,"articleSection":99,"keywords":100},"https:\u002F\u002Fschema.org","TechArticle",{"@type":85,"name":86,"url":87},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":85,"name":86,"url":87,"logo":89},{"@type":90,"url":91},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":93,"name":6,"description":94,"additionalType":95},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":97,"@id":98},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-0621","Cybersecurity","CVE-2026-0621, CVE-2026-0621 vulnerability, CVE-2026-0621 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[102],{"Operator":28,"Negate":28,"Nodes":103},[104],{"Operator":105,"Negate":74,"CPEMatch":106},"OR",[107],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":108,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":109},"202F86B2-BC6C-4F68-9579-84F6F266CF78","1.25.1",[],[112],{"id":113,"eventType":114,"eventTime":115,"details":116,"label":117,"color":118},"f1fff5d6-384a-4181-b85c-72b285a8a181","NEW_NVD","2026-01-06T04:01:21.58614+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":120,"version":121},1792364705589,"2.0",{"score":123,"band":124,"action":125,"scoredAt":126},46,"Medium","Plan remediation","2026-10-16T07:10:40.132084+00:00"]