fix: prevent ReDoS vulnerability in UriTemplate regex patterns by DevJanderson · Pull Request #1363 · modelcontextprotocol/typescript-sdk
Replace vulnerable regex pattern `([^/]+(?:,[^/]+)*)` with `([^/,]+(?:,[^/,]+)*)` to prevent catastrophic backtracking when processing malicious URIs with many commas. The fix explicitly excludes commas from the first character class, preventing nested quantifier backtracking. Fixes #965
This was referenced
Jan 7, 2026This was referenced
Jan 7, 2026This was referenced
Jan 15, 2026This was referenced
Jan 22, 2026This was referenced
Jan 29, 2026This was referenced
Feb 6, 2026This was referenced
Feb 15, 2026This was referenced
Feb 22, 2026This was referenced
Mar 3, 2026This was referenced
Mar 12, 2026This was referenced
Mar 21, 2026This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters