CVE-2026-76892 in mcp-server
Summary
by MITRE • 11/05/2026
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in tsParticles versions prior to 4.3.1 represents a critical reliability flaw within its Model Context Protocol server implementation. Specifically, the HTTP mode of the @tsparticles/mcp-server component contains an insufficient error handling mechanism in the POST /mcp handler located at integrations/mcp-server/src/index.ts. The core technical deficiency lies in the execution of JSON.parse on incoming request bodies without being wrapped within a request-local try-catch block or equivalent error boundary. This architectural oversight means that any malformed JSON payload sent to this endpoint triggers an uncaught SyntaxError during the parsing phase, which propagates up the call stack and ultimately terminates the entire Node.js process running the MCP service.
From a security operations perspective, this flaw constitutes a classic Denial of Service vulnerability driven by improper input validation and error handling. An attacker can exploit this condition remotely without any form of authentication or prior access credentials. By sending a single HTTP POST request with a syntactically invalid JSON body to the /mcp endpoint, an adversary can cause immediate service disruption. The impact is severe because it does not merely degrade performance but results in complete process termination. Consequently, the MCP service becomes entirely unavailable until an external supervisor or container orchestration system detects the failure and restarts the application instance. This creates a persistent availability risk for any infrastructure relying on this component for real-time particle animation data exchange via the Model Context Protocol.
This issue aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to validate input structure before processing and lacks robust exception handling mechanisms to recover from expected error states like malformed JSON. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates Remote Service Availability Impact techniques where an adversary leverages unauthenticated access to disrupt service availability through resource exhaustion or application crashes. The lack of a request-scoped error boundary means the application does not isolate failures to individual requests, allowing a single malicious input to crash the global event loop and all concurrent connections handled by that Node.js process.
To mitigate this vulnerability, organizations must immediately upgrade tsParticles to version 4.3.1 or later, where the developers have implemented proper error boundaries around JSON parsing operations. For environments unable to patch immediately due to dependency constraints, defensive measures should include placing a reverse proxy in front of the MCP server that validates incoming payloads for basic structural integrity before forwarding them to the application layer. Additionally, deploying an external process manager such as PM2 or utilizing container orchestration platforms with automatic restart policies can help minimize downtime by quickly recovering from crashes caused by this specific flaw until a permanent code-level fix is applied.