CVE-2026-76892 PUBLISHED

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Assigner: GitHub_M
Reserved: 19.08.2026 Published: 04.11.2026 Updated: 04.11.2026

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor tsparticles
Product tsparticles
Versions
  • Version < 4.3.1 is affected
Vendor @tsparticles
Product mcp-server
Versions
  • Version < 4.3.1 is affected

References

Problem Types

  • CWE-248: Uncaught Exception CWE