{"id":"CVE-2026-76892","kind":"vulnerability","aliases":["CVE-2026-76892"],"related":[],"title":"tsParticles MCP server: one malformed request crashes the Node process","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","summary":"The HTTP mode of the tsParticles MCP server parses request bodies without catching errors, so one unauthenticated request with malformed JSON throws and terminates the Node.js process. An attacker gets a denial of service: the MCP service stays down until something restarts it.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","node.js","self-hosted","tsparticles"],"not_affected_if":["stdio-transport","version-4.3.1-or-later"],"how_to_check":"- Check the installed version of `@tsparticles/mcp-server` in your lockfile or with `npm ls @tsparticles/mcp-server`\n- Look for an HTTP deployment of the server that exposes the `POST /mcp` endpoint\n- Confirm whether any process supervisor restarts the service automatically","fix":"- `@tsparticles/mcp-server` to `4.3.1` or later","status":"open","published_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:42+00:00","updated_at":"2026-11-05T00:31:42+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-05T00:31:42Z","model":"claude-haiku-5-5","output":{"fix":"- `@tsparticles/mcp-server` to `4.3.1` or later","reach":"network","title":"tsParticles MCP server: one malformed request crashes the Node process","impact":"low","summary":"The HTTP mode of the tsParticles MCP server parses request bodies without catching errors, so one unauthenticated request with malformed JSON throws and terminates the Node.js process. An attacker gets a denial of service: the MCP service stays down until something restarts it.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","tsparticles","node.js","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated request crashes the MCP service until restarted","analyst_note":"","how_to_check":"- Check the installed version of `@tsparticles/mcp-server` in your lockfile or with `npm ls @tsparticles/mcp-server`\n- Look for an HTTP deployment of the server that exposes the `POST /mcp` endpoint\n- Confirm whether any process supervisor restarts the service automatically","plain_action":"","needs_analyst":false,"not_affected_if":["stdio-transport","version-4.3.1-or-later"],"who_is_affected":"Teams running the tsParticles MCP server in HTTP mode, where the POST /mcp handler is reachable over the network. Stdio-only use of the server does not expose this endpoint, and the sources do not say whether other tsParticles packages are involved.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4318,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-76892':13A,16A '/mcp':99C '4.3.1':81C,134C 'ai':18B 'ai-tool':17B 'anim':78C 'attack':54B 'bodi':36B,108C 'boundari':95C 'call':87C 'catch':38B 'crash':7A 'creat':74C 'customiz':76C 'cve':11A,14A 'denial':57B 'error':39B,94C 'extern':124C 'fix':131C 'get':55B 'handler':100C 'high':75C 'host':24B 'http':27B,83C 'integrations/mcp-server/src/index.ts':102C 'issu':129C 'json':46B,107C 'json.parse':88C 'leav':117C 'librari':72C 'local':93C 'malform':5A,45B,106C 'mcp':2A,20B,32B,61B,119C 'mode':28B,84C 'node':9A 'node.js':21B,51B,115C 'one':4A,41B 'outsid':89C 'pars':34B 'particl':77C 'post':98C 'prior':79C 'process':10A,52B,116C 'rais':109C 'request':6A,35B,43B,92C 'request-loc':91C 'restart':67B,126C 'self':23B 'self-host':22B 'server':3A,33B 'servic':59B,62B,120C 'singl':104C 'someth':66B 'stay':63B 'supervisor':125C 'syntaxerror':111C 'termin':49B,113C 'throw':47B 'tool':19B 'tsparticl':1A,25B,31B,68C 'tsparticles/mcp-server':86C 'typescript':71C 'unauthent':42B,105C 'unavail':121C 'version':133C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running the tsParticles MCP server in HTTP mode, where the POST /mcp handler is reachable over the network. Stdio-only use of the server does not expose this endpoint, and the sources do not say whether other tsParticles packages are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","mcp","nodejs","selfhosted","tsparticles"],"campaign_type":null,"first_public_at":"2026-07-10T09:52:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76892","severity":null,"published_at":"2026-11-04T23:17:58+00:00","modified_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71180,"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71497,"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-10T09:52:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}