CVE-2026-76892

Malformed JSON can terminate the tsParticles MCP process

tsParticles · @tsparticles/mcp-server HTTP mode

First documented disclosure · Review checkpoint

Summary

A single invalid HTTP request can shut down the service for other clients.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher reproduced process termination on 4.3.0. No malicious exploitation is documented in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

JSON parsing happened outside a request-scoped error handler. An exception from malformed input could end the Node.js process.

Conditions required

Network access to the HTTP MCP endpoint. No authentication or large request body is needed.

Potential impact

The process exits and clients lose service until a supervisor or operator restarts it.

Affected versions and configurations

Versions before 4.3.1. The researcher reproduced the process exit on 4.3.0.

Fix and mitigation status

4.3.1 catches invalid JSON and returns HTTP 400.

Practical next steps

Deploy a supported fixed release and verify that an invalid request fails locally while another client can still connect.

Operating lesson

Give each incoming request its own parsing and error boundary.

Evidence and limits

July 1 is the public parser change. The July 10 advisory describes a controlled reproduction. The November 4 CVE is separate from the memory-exhaustion issue fixed in the same release.

Sources