modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(server): validate Content-Type by parsed media type instead of substring match (#2441)

Browse source
This commit is contained in:
Felix Weinberger 2026-07-06 20:29:58 +01:00 • committed by GitHub
commit 561c6d8345
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 452 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

23
.changeset/content-type-media-type-validation.md Normal file
View file

@ -0,0 +1,23 @@
---
'@modelcontextprotocol/server': patch
'@modelcontextprotocol/client': patch
'@modelcontextprotocol/hono': patch
'@modelcontextprotocol/node': patch
---
POSTs whose `Content-Type` media type is not `application/json` are now
rejected with `415 Unsupported Media Type`; the header is parsed instead of
substring-matched. Previously any value merely containing the substring
passed the check (for example `text/plain; a=application/json`), case
variants were wrongly rejected, and the 2026-07-28 entry did not inspect
`Content-Type` at all — requests with a missing or non-JSON header that used
to be served on that path now also answer 415. Values with parameters
(`application/json; charset=utf-8`, including malformed parameter sections
like `application/json;`) continue to work. SDK clients always send the
correct header and are unaffected.
The new `isJsonContentType(header)` helper is exported for transport and
framework-adapter authors — custom entries composing the exported building
blocks (`classifyInboundRequest`, `PerRequestHTTPServerTransport`) must apply
it themselves. The hono adapter's JSON body pre-parse and the client's
response dispatch now use the same parsed-media-type comparison.