CVE-2026-76892 Details
Description
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
A denial-of-service vulnerability has been identified in the tsParticles library, specifically in the @tsparticles/mcp-server package, prior to version 4.3.1. The issue arises in the HTTP POST /mcp handler, where incoming request bodies are parsed with JSON.parse() without proper error handling. This flaw allows a single unauthenticated request containing malformed JSON to trigger a SyntaxError, causing the Node.js process to crash. As a result, the MCP service becomes unavailable until manually restarted.
Users can upgrade to tsParticles version 4.3.1 or later, where this issue has been fixed. The patch involves wrapping the JSON parsing in a try/catch block to handle errors gracefully and return a 400 Bad Request response for invalid JSON, allowing the process to remain active.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b | [email protected] | Source CodeVendor |
| https://github.com/tsparticles/tsparticles/pull/5875 | [email protected] | Source CodeVendor |
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tsParticles | All versions |
CPE
Remediation
| |
| tsParticles MCP Server | <= 4.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |