Skip to content
OpenAdvisories
High · 8.7 CVE-2026-76892 EUVD-2026-117159GHSA-4p8p-pjpq-2w7h

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Published Nov 4, 2026 · Updated Nov 5, 2026 · Assigned by GitHub_M

Description

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

Affected products

VendorProductAffectedFixed
tsparticles tsparticles < 4.3.1 —
@tsparticles mcp-server < 4.3.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @tsparticles/mcp-server < 4.3.1 4.3.1 GHSA-4p8p-pjpq-2w7h

References