{"id":"CVE-2026-76892","aliases":["EUVD-2026-117159","GHSA-4p8p-pjpq-2w7h"],"status":"published","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00291,"percentile":0.21917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-11-04T22:14:13.918Z","modified":"2026-11-09T21:30:07Z","fixes":[{"ecosystem":"npm","package":"@tsparticles/mcp-server","fixed_in":["4.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@tsparticles/mcp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@tsparticles/mcp-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}]}],"products":[{"vendor":"@contentful","product":"mcp-server"},{"vendor":"@tsparticles","product":"mcp-server"},{"vendor":"tsparticles","product":"tsparticles"}],"references":[{"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/tsparticles/tsparticles/pull/5875","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76892","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4p8p-pjpq-2w7h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76892.json","tags":["advisory"]},{"url":"https://github.com/tsparticles/tsparticles","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-76892","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","status":"published","published":"2026-11-04T22:14:13.918Z","modified":"2026-11-05T20:25:01.24Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-05T21:25:06.152449Z"}],"euvd":[{"id":"EUVD-2026-117159","description":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","status":"published","published":"2026-11-09T21:13:55Z","modified":"2026-11-09T21:13:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-09T22:18:21.405141Z"}],"ghsa":[{"id":"GHSA-4p8p-pjpq-2w7h","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","description":"## Summary\n\nThe HTTP mode of `@tsparticles/mcp-server` parses incoming `/mcp` request bodies with `JSON.parse()` outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process.\n\nThis was verified on `v4.3.0` at commit `0266d469aa2d719cb66a9c6bf09aded4186ec17c`. Version `4.3.1` appears to fix this by returning HTTP 400 for invalid JSON.\n\n## Affected Code\n\nThe vulnerable handler is:\n\n    if (req.method === \"POST\" \u0026\u0026 req.url === \"/mcp\") {\n      const body = await new Promise\u003cstring\u003e((resolve, reject) =\u003e {\n        const chunks: Buffer[] = [];\n        req.on(\"data\", (chunk) =\u003e chunks.push(Buffer.from(chunk)));\n        req.on(\"end\", () =\u003e resolve(Buffer.concat(chunks).toString(\"utf8\")));\n        req.on(\"error\", reject);\n      });\n\n      const parsedBody = body ? JSON.parse(body) : undefined;\n      await transport.handleRequest(req, res, parsedBody);\n    }\n\nThe `JSON.parse()` call is not wrapped in `try/catch`.\n\n## Reproduction\n\nStart the HTTP server and send this malformed request:\n\n    POST /mcp HTTP/1.1\n    Content-Type: application/json\n    Mcp-Protocol-Version: 2025-11-25\n\n    {\"jsonrpc\":\n\nObserved result in 3 out of 3 runs:\n\n    exit_code=1\n    SyntaxError: Unexpected end of JSON input\n    at Server.\u003canonymous\u003e (integrations/mcp-server/src/index.ts:407:38)\n\n## Impact\n\nAn unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until restarted by an external supervisor.\n\n## Recommendation\n\nWrap request parsing in a local `try/catch` and return a bounded HTTP 400 response such as:\n\n    {\"error\":\"Invalid JSON\"}\n\nThe process should remain alive after malformed requests.","status":"published","published":"2026-11-09T21:13:55Z","modified":"2026-11-09T21:13:56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-09T21:19:53.571625Z"}],"nvd":[{"id":"CVE-2026-76892","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","status":"published","published":"2026-11-04T23:17:58.557Z","modified":"2026-11-06T21:32:18.733Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-07T00:02:36.119898Z"}],"osv":[{"id":"CVE-2026-76892","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","status":"published","published":"2026-11-04T22:14:13.918Z","modified":"2026-11-07T02:30:52.122962055Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-07T03:08:10.477794Z"},{"id":"GHSA-4p8p-pjpq-2w7h","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","description":"## Summary\n\nThe HTTP mode of `@tsparticles/mcp-server` parses incoming `/mcp` request bodies with `JSON.parse()` outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process.\n\nThis was verified on `v4.3.0` at commit `0266d469aa2d719cb66a9c6bf09aded4186ec17c`. Version `4.3.1` appears to fix this by returning HTTP 400 for invalid JSON.\n\n## Affected Code\n\nThe vulnerable handler is:\n\n    if (req.method === \"POST\" \u0026\u0026 req.url === \"/mcp\") {\n      const body = await new Promise\u003cstring\u003e((resolve, reject) =\u003e {\n        const chunks: Buffer[] = [];\n        req.on(\"data\", (chunk) =\u003e chunks.push(Buffer.from(chunk)));\n        req.on(\"end\", () =\u003e resolve(Buffer.concat(chunks).toString(\"utf8\")));\n        req.on(\"error\", reject);\n      });\n\n      const parsedBody = body ? JSON.parse(body) : undefined;\n      await transport.handleRequest(req, res, parsedBody);\n    }\n\nThe `JSON.parse()` call is not wrapped in `try/catch`.\n\n## Reproduction\n\nStart the HTTP server and send this malformed request:\n\n    POST /mcp HTTP/1.1\n    Content-Type: application/json\n    Mcp-Protocol-Version: 2025-11-25\n\n    {\"jsonrpc\":\n\nObserved result in 3 out of 3 runs:\n\n    exit_code=1\n    SyntaxError: Unexpected end of JSON input\n    at Server.\u003canonymous\u003e (integrations/mcp-server/src/index.ts:407:38)\n\n## Impact\n\nAn unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until restarted by an external supervisor.\n\n## Recommendation\n\nWrap request parsing in a local `try/catch` and return a bounded HTTP 400 response such as:\n\n    {\"error\":\"Invalid JSON\"}\n\nThe process should remain alive after malformed requests.","status":"published","published":"2026-11-09T21:13:55Z","modified":"2026-11-09T21:30:07.585268776Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-09T21:40:33.762141Z"}]}}