CVE-2026-76892 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The HTTP mode of the tsParticles MCP server parses request bodies without catching errors, so one unauthenticated request with malformed JSON throws and terminates the Node.js process. An attacker gets a denial of service: the MCP service stays down until something restarts it.
first public Jul 10, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the tsParticles MCP server in HTTP mode, where the POST /mcp handler is reachable over the network. Stdio-only use of the server does not expose this endpoint, and the sources do not say whether other tsParticles packages are involved.
Not affected if stdio-transport, version-4.3.1-or-later
Who cares mcp, node.js, self-hosted, tsparticles
@tsparticles/mcp-server in your lockfile or with npm ls @tsparticles/mcp-serverPOST /mcp endpoint@tsparticles/mcp-server to 4.3.1 or latertsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.