CVE-2026-76892
tsParticles is a TypeScript library for creating highly customizable particle animations
- Risk score
- 57/100
- CVSS
- 8.7 v4.0
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raise…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.3.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
Last activity 4 Nov 2026. Patch Forecast updates every hour.