{"id":"CVE-2026-111768","aliases":["CLSA-2026-1792574765","CLSA-2026-1793100011","CLSA-2026-1793100046","CLSA-2026-1793102412","CLSA-2026-1793112043","CLSA-2026-1793112371","CLSA-2026-1793113170","CLSA-2026-1793887996","EUVD-2026-117803","GHSA-46jr-4wx8-v453","ROOT-APP-NPM-CVE-2026-111768"],"status":"published","title":"Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","description":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00598,"percentile":0.49129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-10-20T20:06:35Z","modified":"2026-11-06T13:15:16Z","fixes":[{"ecosystem":"npm","package":"@modelcontextprotocol/sdk","fixed_in":["1.32.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@modelcontextprotocol/server","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","fixed_in":["1.29.0-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@modelcontextprotocol/server","fixed_in":["2.0.0-aikido.1","2.0.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@modelcontextprotocol/sdk","fixed_in":["1.30.0-aikido.2","1.31.0-aikido.1","1.29.0-aikido.2","1.26.0-aikido.3","1.26.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/modelcontextprotocol__server","fixed_in":["2.0.0-root.io.1","2.0.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/modelcontextprotocol__sdk","fixed_in":["1.30.0-root.io.2","1.31.0-root.io.1","1.29.0-root.io.2","1.26.0-root.io.3","1.26.0-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.32.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@modelcontextprotocol/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.1-tuxcare.0"},{"fixed":"1.30.1-tuxcare.2"}]}],"versions":["1.30.1","1.30.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.0-tuxcare.0"},{"fixed":"1.30.0-tuxcare.2"}]}],"versions":["1.30.0","1.30.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0-tuxcare.0"},{"fixed":"1.26.0-tuxcare.2"}]}],"versions":["1.26.0","1.26.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0-tuxcare.0"},{"fixed":"1.29.0-tuxcare.3"}]}],"versions":["1.29.0","1.29.0-tuxcare.1","1.29.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.2-tuxcare.0"},{"fixed":"1.25.2-tuxcare.4"}]}],"versions":["1.25.2","1.25.2-tuxcare.1","1.25.2-tuxcare.2","1.25.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.3-tuxcare.0"},{"fixed":"1.13.3-tuxcare.2"}]}],"versions":["1.13.3","1.13.3-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.0-tuxcare.0"},{"fixed":"1.24.0-tuxcare.4"}]}],"versions":["1.24.0","1.24.0-tuxcare.1","1.24.0-tuxcare.2","1.24.0-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.3-tuxcare.0"},{"fixed":"1.17.3-tuxcare.4"}]}],"versions":["1.17.3","1.17.3-tuxcare.1","1.17.3-tuxcare.2","1.17.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.32.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@modelcontextprotocol/server","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@modelcontextprotocol/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-aikido.1"},{"fixed":"2.0.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@modelcontextprotocol/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-aikido.2"},{"fixed":"1.31.0-aikido.1"},{"fixed":"1.29.0-aikido.2"},{"fixed":"1.26.0-aikido.3"},{"fixed":"1.26.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/modelcontextprotocol__server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-root.io.1"},{"fixed":"2.0.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/modelcontextprotocol__sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-root.io.2"},{"fixed":"1.31.0-root.io.1"},{"fixed":"1.29.0-root.io.2"},{"fixed":"1.26.0-root.io.3"},{"fixed":"1.26.0-root.io.4"}]}]}],"products":[{"vendor":"@modelcontextprotocol","product":"sdk"},{"vendor":"@modelcontextprotocol","product":"server"},{"vendor":"devolutions","product":"server"},{"vendor":"modelcontextprotocol","product":"typescript-sdk"},{"vendor":"redwoodjs","product":"sdk"}],"references":[{"url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-46jr-4wx8-v453"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111768.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111768","tags":["advisory"]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-111768","title":"Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","description":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.","status":"published","published":"2026-11-05T21:22:44.119Z","modified":"2026-11-09T17:41:55.626Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-09T19:34:28.960398Z"}],"euvd":[{"id":"EUVD-2026-117803","description":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.","status":"published","published":"2026-11-05T21:22:44Z","modified":"2026-11-09T17:41:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T19:17:50.619241Z"}],"ghsa":[{"id":"GHSA-46jr-4wx8-v453","title":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","description":"### Summary\nIn affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.\n\nNo credentials are needed, unless you authenticate requests before they reach the SDK.\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes:\n\n1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result.\n2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit.\n\nIf you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.","status":"published","published":"2026-10-20T20:06:35Z","modified":"2026-10-20T20:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-111768","description":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.","status":"published","published":"2026-11-05T22:17:45.457Z","modified":"2026-11-12T22:18:35.61Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-09T20:15:34.274131Z"}],"osv":[{"id":"CVE-2026-111768","title":"Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","description":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.","status":"published","published":"2026-11-05T21:22:44.119Z","modified":"2026-11-11T02:30:41.210020463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-07T03:08:00.544003Z"},{"id":"GHSA-46jr-4wx8-v453","title":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","description":"### Summary\nIn affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.\n\nNo credentials are needed, unless you authenticate requests before they reach the SDK.\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes:\n\n1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result.\n2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit.\n\nIf you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.","status":"published","published":"2026-10-20T20:06:35Z","modified":"2026-10-20T20:15:05.222078887Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"CLSA-2026-1792574765","title":"TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 2 CVEs. Fixed in 1.30.1-tuxcare.2.","status":"published","published":"2026-10-21T09:26:05Z","modified":"2026-10-21T14:00:21.015840087Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793100011","title":"TuxCare security update for @modelcontextprotocol/sdk (3 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 3 CVEs. Fixed in 1.30.0-tuxcare.2.","status":"published","published":"2026-10-27T11:20:11Z","modified":"2026-10-27T13:30:13.922723781Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100046","title":"TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 2 CVEs. Fixed in 1.26.0-tuxcare.2.","status":"published","published":"2026-10-27T11:20:46Z","modified":"2026-10-27T13:30:10.222183432Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102412","title":"TuxCare security update for @modelcontextprotocol/sdk (1 CVE)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.29.0-tuxcare.3.","status":"published","published":"2026-10-27T12:00:12Z","modified":"2026-10-27T13:30:14.986886564Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793112043","title":"TuxCare security update for @modelcontextprotocol/sdk (4 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 4 CVEs. Fixed in 1.25.2-tuxcare.4.","status":"published","published":"2026-10-27T14:40:43Z","modified":"2026-10-30T19:46:05.142474665Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793112371","title":"TuxCare security update for @modelcontextprotocol/sdk (6 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 6 CVEs. Fixed in 1.13.3-tuxcare.2.","status":"published","published":"2026-10-27T14:46:11Z","modified":"2026-10-30T19:45:13.789904458Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793113170","title":"TuxCare security update for @modelcontextprotocol/sdk (4 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 4 CVEs. Fixed in 1.24.0-tuxcare.4.","status":"published","published":"2026-10-27T14:59:30Z","modified":"2026-10-30T19:46:06.482679292Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793887996","title":"TuxCare security update for @modelcontextprotocol/sdk (3 CVEs)","description":"TuxCare rebuilt @modelcontextprotocol/sdk to address 3 CVEs. Fixed in 1.17.3-tuxcare.4.","status":"published","published":"2026-11-05T15:13:17Z","modified":"2026-11-06T13:15:16.797880742Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"ROOT-APP-NPM-CVE-2026-111768","title":"CVE-2026-111768 in @modelcontextprotocol/server - Patched by Root","description":"Root has patched CVE-2026-111768 in the @modelcontextprotocol/server package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T08:51:21Z","modified":"2026-10-30T09:15:37.393761653Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}