tsparticles has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-76892High· 8.7tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process60CVE-2026-76826High· 7.5tsParticles: Generated release notes can execute shell commands in the stable publish workflow53CVE-2026-63655High· 7.5tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS53CVE-2026-76893Medium· 6.9tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients50
tsparticles vulnerabilities
CVEs affecting tsparticles, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-76892High· 8.7PoCtsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integr…
CVE-2026-76826High· 7.5PoCtsParticles: Generated release notes can execute shell commands in the stable publish workflow
tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before wri…
CVE-2026-76893Medium· 6.9PoCtsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated cli…
CVE-2026-63655High· 7.5PoCtsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and acc…