[GHSA-m5pj-3536-3xcp] - [v1] - /fetch proxy has no size cap on the proxied response body (memory-exhaustion DoS) #2781

Advisory: GHSA-m5pj-3536-3xcp

Affected versions: @modelcontextprotocol/inspector and @modelcontextprotocol/inspector-server >= 0.21.2, <= 1.0.2 (v1 half; the v2 half, >= 2.0.0, <= 2.11.0, is #2780)

Reporter: @CloneOfAlex

Severity: medium | Reported: 2026-09-18

The v1 proxy's /fetch route read the upstream response body with no size cap, so a remote server could exhaust the proxy's memory with an oversized response. The advisory holds the full report.

This issue tracks the v1 line. The advisory's draft card was converted into the v2 issue, #2780, so this one was filed separately for board #11.