CVE-2026-76892

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary

The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse() outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process.

This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON.

Affected Code

The vulnerable handler is:

if (req.method === "POST" && req.url === "/mcp") {
  const body = await new Promise<string>((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });

  const parsedBody = body ? JSON.parse(body) : undefined;
  await transport.handleRequest(req, res, parsedBody);
}

The JSON.parse() call is not wrapped in try/catch.

Reproduction

Start the HTTP server and send this malformed request:

POST /mcp HTTP/1.1
Content-Type: application/json
Mcp-Protocol-Version: 2025-11-25

{"jsonrpc":

Observed result in 3 out of 3 runs:

exit_code=1
SyntaxError: Unexpected end of JSON input
at Server.<anonymous> (integrations/mcp-server/src/index.ts:407:38)

Impact

An unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until restarted by an external supervisor.

Recommendation

Wrap request parsing in a local try/catch and return a bounded HTTP 400 response such as:

{"error":"Invalid JSON"}

The process should remain alive after malformed requests.

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Summary

The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse() outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process.

This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON.

Affected Code

The vulnerable handler is:

if (req.method === "POST" && req.url === "/mcp") {
  const body = await new Promise<string>((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });

  const parsedBody = body ? JSON.parse(body) : undefined;
  await transport.handleRequest(req, res, parsedBody);
}

The JSON.parse() call is not wrapped in try/catch.

Reproduction

Start the HTTP server and send this malformed request:

POST /mcp HTTP/1.1
Content-Type: application/json
Mcp-Protocol-Version: 2025-11-25

{"jsonrpc":

Observed result in 3 out of 3 runs:

exit_code=1
SyntaxError: Unexpected end of JSON input
at Server.<anonymous> (integrations/mcp-server/src/index.ts:407:38)

Impact

An unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until restarted by an external supervisor.

Recommendation

Wrap request parsing in a local try/catch and return a bounded HTTP 400 response such as:

{"error":"Invalid JSON"}

The process should remain alive after malformed requests.