CVE-2026-63655

Name of the Vulnerable Software and Affected Versions tsParticles versions prior to 4.3.1

Description The HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST requests at the '/mcp' endpoint. The system accumulates every request-body chunk in a Buffer[] without a cumulative size limit before executing Buffer.concat and JSON.parse(). A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory, leading to service termination. This includes the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000.

Recommendations Update to version 4.3.1.