CVE-2026-76893Medium· 6.9▾ TwilightPoC availabletsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated cli…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
tsparticles < 4.3.2mcp-server < 4.3.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76826High· 7.5tsParticles: Generated release notes can execute shell commands in the stable publish workflow
CVE-2026-63655High· 7.5tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
CVE-2026-76892High· 8.7tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
CVE-2023-43786Medium· 5.5Libx11: stack exhaustion from infinite recursion in putsubimage()
CVE-2023-6277Medium· 6.5Libtiff: out-of-memory in tiffopen via a craft file
CVE-2019-5645High· 7.5Rapid7 Metasploit HTTP Handler Denial of Service