CVE-2026-63655

Received Received - Intake

Memory Exhaustion in tsParticles MCP Server

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-63655

Affected Vendors & Products

Vendor	Product	Version / Range
tsparticles	tsparticles	< 4.3.1
@tsparticles	mcp-server	< 4.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects tsParticles' HTTP mode in @tsparticles/mcp-server before version 4.3.1. It allows unauthenticated POST requests to /mcp endpoints. The server accumulates request body chunks in memory without size limits before processing, enabling memory exhaustion attacks by streaming large payloads.

Detection Guidance

Check if @tsparticles/mcp-server is running in HTTP mode on port 3000. Use netstat or ss to verify open ports. Monitor for unusually high memory usage in the Node.js process hosting the server.

Impact Analysis

An attacker could send large requests to exhaust server memory, causing the Node.js process to crash. This leads to denial-of-service, making the service unavailable. Confidentiality and integrity of data are not compromised, but availability is severely impacted.

Compliance Impact

This vulnerability does not directly affect confidentiality or integrity of data, so it may not directly violate GDPR or HIPAA requirements. However, availability impacts from denial-of-service could indirectly affect compliance by disrupting services handling personal or health data.

Mitigation Strategies

Upgrade @tsparticles/mcp-server to version 4.3.1 or later. If upgrading is not possible, disable HTTP mode or restrict network access to the service to prevent unauthenticated requests.

Hi! I’m here to help you understand CVE-2026-63655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...