CVE-2026-76893 · Package
NO FIX YET · SEE WHAT TO DO
The HTTP mode of the tsParticles MCP server shares one stateful transport across all clients. An unauthenticated client that sends the first initialize request can keep later clients from opening sessions until the process restarts.
first public Jul 10, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only teams running the @tsparticles/mcp-server package in HTTP mode, where it is reachable by clients over a network. The sources describe a denial of service on the shared session, with the first client's session still working. Stdio-mode use and projects that do not run this MCP server are not described as affected.
Not affected if no-mcp-server, stdio-mode
Who cares mcp, node.js, self-hosted, tsparticles
@tsparticles/mcp-server in the project lockfile or with npm ls @tsparticles/mcp-server@tsparticles/mcp-server to 4.3.2 or latertsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.