CVE-2026-63655High· 7.5▾ MidnightPoC availabletsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and acc…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.
tsparticles < 4.3.1mcp-server < 4.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76892High· 8.7tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
CVE-2026-76893Medium· 6.9tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
CVE-2026-76826High· 7.5tsParticles: Generated release notes can execute shell commands in the stable publish workflow
CVE-2023-43786Medium· 5.5Libx11: stack exhaustion from infinite recursion in putsubimage()
CVE-2023-6277Medium· 6.5Libtiff: out-of-memory in tiffopen via a craft file
CVE-2019-5645High· 7.5Rapid7 Metasploit HTTP Handler Denial of Service