fix: prevent ReDoS vulnerability in UriTemplate regex patterns by DevJanderson · Pull Request #1363 · modelcontextprotocol/typescript-sdk

@DevJanderson

Replace vulnerable regex pattern `([^/]+(?:,[^/]+)*)` with
`([^/,]+(?:,[^/,]+)*)` to prevent catastrophic backtracking
when processing malicious URIs with many commas.

The fix explicitly excludes commas from the first character class,
preventing nested quantifier backtracking.

Fixes #965

@pcarleton

pcarleton

This was referenced

Jan 7, 2026

This was referenced

Jan 7, 2026

This was referenced

Jan 15, 2026

This was referenced

Jan 22, 2026

This was referenced

Jan 29, 2026

This was referenced

Feb 6, 2026

This was referenced

Feb 15, 2026

This was referenced

Feb 22, 2026

This was referenced

Mar 3, 2026

This was referenced

Mar 12, 2026

This was referenced

Mar 21, 2026

mozmo15 pushed a commit to mozmo15/typescript-sdk that referenced this pull request

Mar 30, 2026