CVE-2026-0621 is a high-severity vulnerability in Anthropic's MCP TypeScript SDK (up to version 1.25.1) involving the UriTemplate class. The vulnerability is due to a regular expression denial of service (ReDoS) caused by nested quantifiers in dynamically generated regular expressions used for URI matching of RFC 6570 exploded array patterns. This can lead to catastrophic backtracking and excessive CPU usage when processing specially crafted inputs, potentially causing the Node.js process to become unresponsive and resulting in denial of service.

An attacker can exploit this vulnerability by providing a malicious URI that triggers catastrophic backtracking in the regular expression engine, leading to excessive CPU consumption and denial of service of the affected Node.js process running the MCP TypeScript SDK. This can disrupt service availability but does not involve privilege escalation or data confidentiality/integrity impacts as per the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider implementing input validation or limiting URI input complexity to mitigate potential exploitation.