Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M

CVE-2026-76892tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

High 8.7

In plain English

A high-severity security flaw in mcp-server from @tsparticles. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Affected products (as reported)

Vendor	Product	Versions
tsparticles	tsparticles	< 4.3.1
@tsparticles	mcp-server	< 4.3.1

Weakness: CWE-248 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5875 x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b x_refsource_MISC