CVE-2026-76892

UNKNOWN 0.0

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

CWE	CWE-248
Vendor	tsparticles
Product	tsparticles
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for tsparticles tsparticles

Be the first to know when new unknown vulnerabilities affecting tsparticles tsparticles are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

tsparticles / tsparticles

< 4.3.1

@tsparticles / mcp-server

< 4.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h github.com: https://github.com/tsparticles/tsparticles/pull/5875 github.com: https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b