Threats affecting pkg:github/quantgeekdev/mcp-framework

CVE-2026-39313 is a high-severity vulnerability in the QuantGeekDev mcp-framework versions 0.2.21 and below. The vulnerability arises because the readRequestBody() function concatenates HTTP request body chunks without enforcing any size limit, despite the existence of a maxMessageSize configuration parameter. This allows a remote unauthenticated attacker to send a single large POST request to the /mcp endpoint, causing memory exhaustion and denial of service. The issue has been fixed in version 0.2.22.