CVE-2026-76892

Received Received - Intake

Remote Code Execution Risk in tsParticles MCP Server

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-76892

Affected Vendors & Products

Vendor	Product	Version / Range
tsparticles	tsparticles	< 4.3.1
@tsparticles	mcp-server	< 4.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects tsParticles' MCP server before version 4.3.1. A flaw in the HTTP mode's POST handler allows unauthenticated attackers to crash the Node.js process by sending a malformed JSON request. The crash occurs because JSON.parse is called outside a request-local error boundary, causing a SyntaxError that terminates the service.

Detection Guidance

Check if the @tsparticles/mcp-server is running and exposed to the network. Monitor Node.js processes for crashes after receiving malformed JSON requests. Verify the server version is below 4.3.1.

Impact Analysis

If you use the affected MCP server version, an attacker could send a single malicious request to make the service unavailable. This would disrupt any applications relying on the MCP server until it is manually restarted by an administrator.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing prolonged service unavailability due to process termination. GDPR requires timely breach notification and system availability, while HIPAA mandates continuous access to protected health information systems. The MCP service downtime may lead to disruptions in data processing or access, potentially violating availability requirements.

Mitigation Strategies

Upgrade @tsparticles/mcp-server to version 4.3.1 or later. If immediate upgrade is not possible, restrict network access to the MCP server or disable the HTTP mode until patched.

Hi! I’m here to help you understand CVE-2026-76892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...