fix: prevent ReDoS vulnerability in UriTemplate regex patterns

[DevJanderson]

Summary

This PR fixes the ReDoS (Regular Expression Denial of Service) vulnerability in the UriTemplate class (CVE-2026-0621).

Problem

The regex patterns for exploded array templates ({/id*} and {id*}) used ([^/]+(?:,[^/]+)*) which causes catastrophic backtracking when processing malicious URIs containing many commas.

Solution

Replace the vulnerable pattern with ([^/,]+(?:,[^/,]+)*) - explicitly excluding commas from the first character class prevents nested quantifier backtracking.

Changes

• packages/core/src/shared/uriTemplate.ts: Fix regex patterns on lines 228 and 238
• packages/core/test/shared/uriTemplate.test.ts: Add regression tests for ReDoS

Testing

All existing tests pass, plus 2 new tests verify the fix prevents ReDoS:

• should not be vulnerable to ReDoS with exploded path patterns
• should not be vulnerable to ReDoS with exploded simple patterns

Fixes #965

[changeset-bot]

🦋 Changeset detected

Latest commit: 277a216

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1363

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1363

commit: 277a216

[tats-u]

@DevJanderson You need to add a changeset first via pnpm changeset first. (Disclaimer: I'm not a maintainer) The change itself matches what I came up with.

https://makenowjust-labs.github.io/recheck/playground/ said the original regex (with ^ and $; /^([^\/]+(?:,[^\/]+)*)$/) is exponential (vulnerable) and the fixed regex is safe.

[tats-u]

One more thing you may need to send another PR with the same content to the v1.x branch as a backport, too.

[pcarleton]

LGTM, thank you!

[pkuczynski]

Any plans for getting a new release with this fix?