From 0f9840d59fa8462476b21941d38260aa3f4bad47 Mon Sep 17 00:00:00 2001
From: Muzzy5150 <210135147+Muzzy5150@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:04:12 -0700
Subject: [PATCH] Correct affected-version description for GHSA-8r9q-7v3j-jr4g

---
 .../2026/01/GHSA-8r9q-7v3j-jr4g/GHSA-8r9q-7v3j-jr4g.json        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/advisories/github-reviewed/2026/01/GHSA-8r9q-7v3j-jr4g/GHSA-8r9q-7v3j-jr4g.json b/advisories/github-reviewed/2026/01/GHSA-8r9q-7v3j-jr4g/GHSA-8r9q-7v3j-jr4g.json
index 29ffd276ffc7..da44f95e755f 100644
--- a/advisories/github-reviewed/2026/01/GHSA-8r9q-7v3j-jr4g/GHSA-8r9q-7v3j-jr4g.json
+++ b/advisories/github-reviewed/2026/01/GHSA-8r9q-7v3j-jr4g/GHSA-8r9q-7v3j-jr4g.json
@@ -7,7 +7,7 @@
     "CVE-2026-0621"
   ],
   "summary": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
-  "details": "### Impact\n\nA ReDoS vulnerability in the `UriTemplate` class allows attackers to cause denial of service. The `partToRegExp()` function generates a regex pattern with nested quantifiers (`([^/]+(?:,[^/]+)*)`) for exploded template variables (e.g., `{/id*}`, `{?tags*}`), causing catastrophic backtracking on malicious input.\n\n**Who is affected:** MCP servers that register resource templates with exploded array patterns and accept requests from untrusted clients.\n\n**Attack result:** An attacker sends a crafted URI via `resources/read` request, causing 100% CPU utilization, server hang/crash, and denial of service for all clients.\n\n### Affected Versions\n\nAll versions of `@modelcontextprotocol/sdk` prior to the patched release.\n\n### Patches\n\nv1.25.2 contains b392f02ffcf37c088dbd114fedf25026ec3913d3 the fix modifies the regex pattern to prevent backtracking.\n\n### Workarounds\n\n- Avoid using exploded patterns (`{/id*}`, `{?tags*}`) in resource templates\n- Implement request timeouts and rate limiting\n- Validate URIs before processing to reject suspicious patterns",
+  "details": "### Impact\n\nA ReDoS vulnerability in the `UriTemplate` class allows attackers to cause denial of service. The `partToRegExp()` function generates a regex pattern with nested quantifiers (`([^/]+(?:,[^/]+)*)`) for exploded template variables (e.g., `{/id*}`, `{?tags*}`), causing catastrophic backtracking on malicious input.\n\n**Who is affected:** MCP servers that register resource templates with exploded array patterns and accept requests from untrusted clients.\n\n**Attack result:** An attacker sends a crafted URI via `resources/read` request, causing 100% CPU utilization, server hang/crash, and denial of service for all clients.\n\n### Affected Versions\n\n`@modelcontextprotocol/sdk` versions `>= 1.3.0` and `< 1.25.2` are affected.\n\n### Patches\n\nv1.25.2 contains b392f02ffcf37c088dbd114fedf25026ec3913d3 the fix modifies the regex pattern to prevent backtracking.\n\n### Workarounds\n\n- Avoid using exploded patterns (`{/id*}`, `{?tags*}`) in resource templates\n- Implement request timeouts and rate limiting\n- Validate URIs before processing to reject suspicious patterns",
   "severity": [
     {
       "type": "CVSS_V4",