Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M

CVE-2026-76893tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

Medium 6.9

In plain English

A medium-severity uncontrolled resource consumption in mcp-server from @tsparticles. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.

Affected products (as reported)

Vendor	Product	Versions
tsparticles	tsparticles	< 4.3.2
@tsparticles	mcp-server	< 4.3.2

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9 x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5888 x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896 x_refsource_MISC