MCP TypeScript SDK hit by DoS via unbounded request body and JSON-RPC batches

The Model Context Protocol TypeScript SDK has an uncontrolled resource consumption flaw, GHSA-f897-62hf-6gxq, rated CVSS 7.5: HTTP transports do not cap POST body size or JSON-RPC 2.0 batch length, and Express/Hono middleware parse bodies before checking Host and Origin. Unauthenticated attackers can trigger OOM crashes or starve the Node.js event loop. Patches ship in 1.30.1 and 2.1.0/2.0.1 with 4 MiB and 100-message defaults.

• CVSS 7.5, CWE-400: unauthenticated DoS via HTTP POST
• Affects sdk >=1.10.0 <1.30.1 and server, node, hono 2.0.0
• Fixed in 1.30.1, server and node 2.1.0, hono 2.0.1
• New defaults: 4 MiB body limit, 100-message JSON-RPC batch cap