{"id":"CVE-2026-76892","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","summary":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integr…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-248"],"vendor":"tsparticles","product":"tsparticles","affected":["tsparticles < 4.3.1","mcp-server < 4.3.1"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-05T20:24:21.547245Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:25:01.240Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76892","references":[{"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h","label":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"},{"url":"https://github.com/tsparticles/tsparticles/pull/5875","label":"https://github.com/tsparticles/tsparticles/pull/5875"},{"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b","label":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"}],"tags":["cve.org","exploit-available"],"epss":0.00291,"epssPercentile":0.21843,"ingestedAt":"2026-11-05T22:38:31.790Z","slug":"CVE-2026-76892","body":"## Overview\n\ntsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.\n\n## Affected\n\n- `tsparticles < 4.3.1`\n- `mcp-server < 4.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}