CVE-2026-58483: mcp-searxng Memory Exhaustion DOS Vulnerability

CVE-2026-58483 Overview

CVE-2026-58483 affects mcp-searxng, a Model Context Protocol (MCP) server that provides AI assistants with web search and URL-reading capabilities through SearXNG. Versions prior to 1.7.1 contain an uncontrolled resource consumption flaw [CWE-400] in the web_url_read tool. A remote HTTP server that omits the Content-Length header bypasses the URL_READ_MAX_CONTENT_LENGTH_BYTES preflight check, forcing the server to buffer the entire response body into memory. The buffered string is then processed by NodeHtmlMarkdown.translate(), amplifying CPU consumption. An unauthenticated attacker can trigger denial of service against any MCP client that reads attacker-influenced URLs.

Critical Impact
Unauthenticated remote attackers can exhaust memory and CPU on any host running mcp-searxng prior to version 1.7.1 by serving oversized responses without a Content-Length header.

Affected Products

mcp-searxng versions prior to 1.7.1
MCP clients and AI assistants integrated with vulnerable mcp-searxng servers
Deployments exposing the web_url_read tool to caller-supplied URLs

Discovery Timeline

2026-09-15 - CVE-2026-58483 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-58483

Vulnerability Analysis

The web_url_read handler in src/index.ts forwards a caller-supplied URL to readUrlContent() in src/url-reader.ts. That function calls checkContentLength() to enforce the configured maximum response size. When the upstream HTTP server omits the Content-Length header, checkContentLength() treats the preflight as inconclusive and permits the request to proceed. Both the success and error branches then invoke response.text(), which reads the entire response body into a single string with no streaming cap.

Once buffered, the string is passed to NodeHtmlMarkdown.translate(), which parses the HTML and converts it to Markdown. Parsing arbitrarily large payloads consumes significant CPU and additional memory beyond the raw body size. A single malicious request can therefore starve the Node.js process of memory or block its event loop, resulting in denial of service for all connected MCP clients.

Root Cause

The root cause is missing enforcement of a byte cap during body consumption. The preflight relies solely on a header that the upstream server controls and can omit. Neither response.text() nor the downstream Markdown parser bounds allocation, so the advertised URL_READ_MAX_CONTENT_LENGTH_BYTES limit is trivially bypassed.

Attack Vector

An attacker hosts an HTTP endpoint that returns a large or infinite response body without a Content-Length header. The attacker then induces the MCP client, or any user of the AI assistant, to invoke web_url_read against that URL. No authentication or user interaction on the target server is required beyond the URL fetch itself.

typescript

// Patch excerpt from src/url-reader.ts introducing a streaming body cap (SEC-022)
type BoundedBodyReadResult =
  | { exceeded: false; text: string; bytesRead: number }
  | { exceeded: true; bytesRead: number };

const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
const MAX_REDIRECTS = 5;
export const DEFAULT_MAX_CONTENT_LENGTH_BYTES = 5 * 1024 * 1024;
// Source: https://github.com/ihor-sokoliuk/mcp-searxng/commit/f5a947ed1650daed10fbdcd53c0db5a86489ffe4

The patch replaces the header-only preflight with a bounded streaming read that tracks bytesRead and short-circuits once the configured cap is exceeded, regardless of whether Content-Length was advertised.

Detection Methods for CVE-2026-58483

Indicators of Compromise

Node.js processes running mcp-searxng showing sustained high memory usage or out-of-memory crashes.
Repeated web_url_read invocations against unusual or attacker-controlled hostnames in MCP server logs.
Outbound HTTP responses to the MCP host lacking a Content-Length header combined with abnormally large transfer sizes.

Detection Strategies

Instrument the mcp-searxng process with resource metrics (RSS, event-loop lag) and alert on rapid growth correlated with web_url_read calls.
Inspect proxy or egress logs for HTTP responses returning large chunked-encoded bodies to the MCP server without Content-Length.
Review MCP audit trails for URLs supplied to web_url_read that resolve to untrusted or newly registered domains.

Monitoring Recommendations

Track process restarts and OOM kills for containers hosting mcp-searxng.
Baseline normal response sizes fetched by the tool and alert on statistical outliers.
Forward MCP server logs and host telemetry to a central data lake for correlation with network egress records.

How to Mitigate CVE-2026-58483

Immediate Actions Required

Upgrade mcp-searxng to version 1.7.1 or later on all hosts running the MCP server.
Restrict which URLs the web_url_read tool may fetch through an allowlist or egress proxy.
Apply per-process memory and CPU limits (for example, via NODE_OPTIONS=--max-old-space-size and container cgroup limits) to contain abuse.

Patch Information

The fix is available in mcp-searxng v1.7.1. The remediation is implemented in pull request #121 and commit f5a947e, which replaces the header-based preflight with a streaming read that enforces URL_READ_MAX_CONTENT_LENGTH_BYTES regardless of missing headers. See GHSA-xcqx-9jf5-w339 for the full advisory.

Workarounds

Route MCP server egress through an HTTP proxy that rejects responses exceeding a fixed byte cap.
Disable or gate the web_url_read tool until the upgrade is deployed.
Run mcp-searxng under strict cgroup memory and CPU limits so a single request cannot destabilize the host.

bash

# Upgrade mcp-searxng to the patched release
npm install mcp-searxng@1.7.1

# Enforce a hard Node.js heap limit as a defense-in-depth control
export NODE_OPTIONS="--max-old-space-size=512"

# Verify installed version
npm ls mcp-searxng