Skip to main content
cve.nowby Sazabi
← npm
npmPackage

mcp-framework

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
0.2.22 (Apr 16, 2026): no advisory affects it
Newest unaffected release
0.2.22 (Apr 16, 2026), the latest release
Advisories
1 · 1 high
Weekly downloads
62.6K
Dependents
91
Releases
148 since 0.1.0 (Dec 8, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

    Affected: fixed in 0.2.22.

    Fixed in 0.2.22 (released Apr 16, 2026, the day of disclosure).

    The latest release, 0.2.22, is not affected.

    54% of mcp-framework downloads last week were affected versions (42.1K).