Pit record
MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM (pkce-challenge)
@modelcontextprotocol/sdk used from a CommonJS project (e.g. NestJS) can crash at MCP client init with ERR_REQUIRE_ESM because an older SDK CJS build statically require()s the ESM-only pkce-challenge. Upgrade the SDK to a version that dynamically imports it, or force pkce-challenge@5.0.0 via overrides.
Markdown mirror | Canonical source
Fast answer
Problem: runtime crash on MCP client init: ERR_REQUIRE_ESM: require() of ES Module pkce-challenge is not supported. Use dynamic import() instead
Root cause: pkce-challenge shipped as ESM-only.
Fix first: Upgrade @modelcontextprotocol/sdk to a version that lazily import()s pkce-challenge.
Verify: Start the CommonJS app and initialize the MCP client.
Queries this answers
- @modelcontextprotocol/sdk fails in CommonJS projects due to incompatible ESM-only dependency pkce-challenge
- @modelcontextprotocol/sdk fails in CommonJS projects due to incompatible ESM-only dependency (pkce-challenge) fix
- @modelcontextprotocol/sdk fails in CommonJS projects due to incompatible ESM-only dependency (pkce-challenge) root cause
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM pkce-challenge
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM (pkce-challenge) fix
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM (pkce-challenge) root cause
- how to fix MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM pkce-challenge
- mcp-server commonjs projects err require esm pkce challenge
Record metadata
| Status | verified |
|---|---|
| Confidence | high |
| Created | 2026-06-21 |
| Updated | 2026-06-21 |
| Last verified | 2026-06-21 |
| Affected tools | mcp-server, typescript-sdk |
| Tags | mcp, typescript-sdk, commonjs, esm, nestjs, pkce-challenge, dependencies |
Common search queries
- mcp-ts-sdk-commonjs-esm-pkce-challenge
- mcp ts sdk commonjs esm pkce challenge
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM pkce-challenge
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM (pkce-challenge) fix
- MCP TypeScript SDK crashes in CommonJS projects with ERR_REQUIRE_ESM (pkce-challenge) root cause
- typescript-sdk
- commonjs
- nestjs
- pkce-challenge
- dependencies
- mcp-server
- runtime crash on MCP client init: ERR_REQUIRE_ESM: require() of ES Module pkce-challenge is not supported. Use dynamic import() instead
Symptoms
- runtime crash on MCP client init: ERR_REQUIRE_ESM: require() of ES Module pkce-challenge is not supported. Use dynamic import() instead
- the project is CommonJS (often NestJS)
- the error originates inside @modelcontextprotocol/sdk/dist/cjs/client/auth.js
Environment
| language | TypeScript |
|---|---|
| runtime | Node.js |
| framework | NestJS / CommonJS |
| constraints | CommonJS module system, pkce-challenge shipped ESM-only |
Root cause
- pkce-challenge shipped as ESM-only.
- The SDK's CommonJS build used a static require('pkce-challenge'), which Node refuses for an ESM-only module from CJS, throwing at load time.
Fix
Upgrade @modelcontextprotocol/sdk to a version that lazily import()s pkce-challenge.
Or force a compatible pkce-challenge (5.0.0) via lockfile / package overrides so the CJS build can load it.
If you cannot upgrade, import from the SDK's ESM build, or as a stopgap apply the community patch that converts the static require to a dynamic import().
Verification
Start the CommonJS app and initialize the MCP client.
Expected: No ERR_REQUIRE_ESM for pkce-challenge.
Workarounds
- Use package-manager overrides to pin pkce-challenge@5.0.0.
- Temporarily import from the SDK's ESM dist.
Anti-patterns
- Pinning a very old SDK (e.g. 1.5.0) just to avoid pkce-challenge, losing later fixes.
- Patching node_modules as a permanent solution instead of upgrading or using overrides.
Sources
No matching fix?
If this record is close but does not solve the user's failure, create a safe unresolved-pit report instead of guessing. Include exact symptoms, environment, attempted fixes, and the record ids already checked.