Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-76892 (GCVE-0-2026-76892)

Vulnerability from nvd – Published: 2026-11-04 22:14 – Updated: 2026-11-05 20:25

Title

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:24 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5875	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.1
@tsparticles	mcp-server	Affected: < 4.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76892",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:24:21.547245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:25:01.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:14:13.918Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5875",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5875"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"
        }
      ],
      "source": {
        "advisory": "GHSA-4p8p-pjpq-2w7h",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76892",
    "datePublished": "2026-11-04T22:14:13.918Z",
    "dateReserved": "2026-08-19T22:43:14.889Z",
    "dateUpdated": "2026-11-05T20:25:01.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76826 (GCVE-0-2026-76826)

Vulnerability from nvd – Published: 2026-11-04 22:11 – Updated: 2026-11-05 20:23

Title

tsParticles: Generated release notes can execute shell commands in the stable publish workflow

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:21 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5888	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tsparticles	tsparticles	Affected: >= 4.0.0, < 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76826",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:21:43.127638Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:23:54.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:11:45.939Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5888",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5888"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896"
        }
      ],
      "source": {
        "advisory": "GHSA-gw8q-3x59-mjjx",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Generated release notes can execute shell commands in the stable publish workflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76826",
    "datePublished": "2026-11-04T22:11:45.939Z",
    "dateReserved": "2026-08-19T19:52:28.214Z",
    "dateUpdated": "2026-11-05T20:23:54.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76893 (GCVE-0-2026-76893)

Vulnerability from nvd – Published: 2026-11-04 22:10 – Updated: 2026-11-05 20:20

Title

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:20 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5888	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.2
@tsparticles	mcp-server	Affected: < 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76893",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:20:28.208419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:20:55.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.2"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client\u0027s session remains functional. This issue is fixed in version 4.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:10:24.167Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5888",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5888"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896"
        }
      ],
      "source": {
        "advisory": "GHSA-h7c4-q426-7jh9",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76893",
    "datePublished": "2026-11-04T22:10:24.167Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-11-05T20:20:55.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63655 (GCVE-0-2026-63655)

Vulnerability from nvd – Published: 2026-11-04 22:01 – Updated: 2026-11-05 20:19

Title

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:18 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5875	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC
https://github.com/tsparticles/tsparticles/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.1
@tsparticles	mcp-server	Affected: < 4.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63655",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:18:43.794353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:19:03.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:01:50.183Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5875",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5875"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-447x-qqwf-m7xq",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63655",
    "datePublished": "2026-11-04T22:01:50.183Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-05T20:19:03.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76892 (GCVE-0-2026-76892)

Vulnerability from cvelistv5 – Published: 2026-11-04 22:14 – Updated: 2026-11-05 20:25

Title

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:24 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5875	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.1
@tsparticles	mcp-server	Affected: < 4.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76892",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:24:21.547245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:25:01.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:14:13.918Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5875",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5875"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"
        }
      ],
      "source": {
        "advisory": "GHSA-4p8p-pjpq-2w7h",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76892",
    "datePublished": "2026-11-04T22:14:13.918Z",
    "dateReserved": "2026-08-19T22:43:14.889Z",
    "dateUpdated": "2026-11-05T20:25:01.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76826 (GCVE-0-2026-76826)

Vulnerability from cvelistv5 – Published: 2026-11-04 22:11 – Updated: 2026-11-05 20:23

Title

tsParticles: Generated release notes can execute shell commands in the stable publish workflow

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:21 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5888	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tsparticles	tsparticles	Affected: >= 4.0.0, < 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76826",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:21:43.127638Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:23:54.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:11:45.939Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5888",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5888"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896"
        }
      ],
      "source": {
        "advisory": "GHSA-gw8q-3x59-mjjx",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Generated release notes can execute shell commands in the stable publish workflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76826",
    "datePublished": "2026-11-04T22:11:45.939Z",
    "dateReserved": "2026-08-19T19:52:28.214Z",
    "dateUpdated": "2026-11-05T20:23:54.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76893 (GCVE-0-2026-76893)

Vulnerability from cvelistv5 – Published: 2026-11-04 22:10 – Updated: 2026-11-05 20:20

Title

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:20 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5888	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.2
@tsparticles	mcp-server	Affected: < 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76893",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:20:28.208419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:20:55.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.2"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client\u0027s session remains functional. This issue is fixed in version 4.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:10:24.167Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5888",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5888"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896"
        }
      ],
      "source": {
        "advisory": "GHSA-h7c4-q426-7jh9",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76893",
    "datePublished": "2026-11-04T22:10:24.167Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-11-05T20:20:55.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63655 (GCVE-0-2026-63655)

Vulnerability from cvelistv5 – Published: 2026-11-04 22:01 – Updated: 2026-11-05 20:19

Title

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:18 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tsparticles/tsparticles/securi…	x_refsource_CONFIRM
https://github.com/tsparticles/tsparticles/pull/5875	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC
https://github.com/tsparticles/tsparticles/commit…	x_refsource_MISC
https://github.com/tsparticles/tsparticles/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
tsparticles	tsparticles	Affected: < 4.3.1
@tsparticles	mcp-server	Affected: < 4.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63655",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:18:43.794353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:19:03.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tsparticles",
          "vendor": "tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        },
        {
          "product": "mcp-server",
          "vendor": "@tsparticles",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:01:50.183Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/pull/5875",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/pull/5875"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea"
        },
        {
          "name": "https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-447x-qqwf-m7xq",
        "discovery": "UNKNOWN"
      },
      "title": "tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63655",
    "datePublished": "2026-11-04T22:01:50.183Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-05T20:19:03.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

8 vulnerabilities by tsparticles

CVE-2026-76892 (GCVE-0-2026-76892)

CVE-2026-76826 (GCVE-0-2026-76826)

CVE-2026-76893 (GCVE-0-2026-76893)

CVE-2026-63655 (GCVE-0-2026-63655)

CVE-2026-76892 (GCVE-0-2026-76892)

CVE-2026-76826 (GCVE-0-2026-76826)

CVE-2026-76893 (GCVE-0-2026-76893)

CVE-2026-63655 (GCVE-0-2026-63655)