CVE-2026-76893 Details
Description
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
A session management vulnerability has been identified in the @tsparticles/mcp-server library, prior to version 4.3.2. The issue arises in the HTTP mode, where a single stateful StreamableHTTPServerTransport instance is reused for all clients. An unauthenticated client that sends an initialize request without an mcp-session-id can claim the shared transport state. This prevents later clients from establishing their own sessions, as they receive a response indicating that the server is already initialized. The first client's session remains active, but subsequent clients are denied service until the process is restarted.
Users can upgrade to version 4.3.2 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896 | [email protected] | Source CodeVendor |
| https://github.com/tsparticles/tsparticles/pull/5888 | [email protected] | Source CodeVendor |
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tsParticles | All versions |
CPE
Remediation
| |
| tsParticles MCP Server | <= 4.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |