Certain versions of the MCP TypeScript SDK and related packages do not limit HTTP POST request body size or JSON-RPC batch length. This allows an attacker to send very large requests or long batches, potentially exhausting server memory and causing denial of service. No authentication is required unless implemented outside the SDK. Fixed versions impose limits on request size and batch length.