PT-2026-137222
CVE-2026-76892
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
tsParticles versions prior to 4.3.1
Description
The HTTP mode of @tsparticles/mcp-server contains a flaw where
JSON.parse is called outside a request-local error boundary within the POST '/mcp' endpoint. An unauthenticated user can send a malformed JSON body, triggering a SyntaxError that terminates the Node.js process. This results in a denial of service, making the MCP service unavailable until it is restarted by an external supervisor.Recommendations
Update to version 4.3.1.
Found an issue in the description? Have something to add? Feel free to write us 👾