CVE-2026-76892: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@tsparticles/mcp-serverto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the HTTP mode of @tsparticles/mcp-server are exposed if they run a version prior to 4.3.1. The affected code path is the POST /mcp handler.
What does an attacker need to exploit this issue?
An attacker only needs network access to send an unauthenticated malformed JSON request to the POST /mcp endpoint. No credentials or user interaction are required.
What is the operational impact of a successful exploit?
A malformed request triggers an unhandled SyntaxError that terminates the Node.js HTTP process. The MCP service remains unavailable until an external supervisor restarts it.
How can this be remediated?
Upgrade @tsparticles/mcp-server to version 4.3.1, which fixes the issue.