CVE-2026-76893

Name of the Vulnerable Software and Affected Versions @tsparticles/mcp-server versions prior to 4.3.2

Description The HTTP mode of the server reuses a single stateful StreamableHTTPServerTransport for every client. An unauthenticated client can claim the shared transport state by sending an initial initialize request without an mcp-session-id. This action causes subsequent independent clients to receive a Server already initialized error, preventing them from establishing sessions until the process is restarted, although the first client's session remains functional.

Recommendations Update to version 4.3.2.