Vulnerability Overview
CVE-2026-76892 is a high-severity denial-of-service vulnerability in the @tsparticles/mcp-server package, a TypeScript library component for creating particle animations. The flaw allows unauthenticated remote attackers to crash the entire Node.js process by sending a single malformed JSON request to the HTTP endpoint.
The vulnerability affects versions prior to 4.3.1 and has been assigned a CVSS v4 score of 8.7.
Technical Details
The vulnerability exists in the HTTP mode POST /mcp handler located in `integrations/mcp-server/src/index.ts`. According to the security advisory, the code calls `JSON.parse()` on incoming request bodies without wrapping the operation in a request-local error boundary or try-catch block.
The vulnerable code pattern is:
“`
const body = await new Promise
const chunks: Buffer[] = [];
req.on(“data, (chunk) => chunks.push(Buffer.from(chunk)));
req.on(end, () => resolve(Buffer.concat(chunks).toString(utf8″)));
req.on(“error, reject);
});
const parsedBody = body ? JSON.parse(body) : undefined;
“`
When `JSON.parse()` encounters malformed JSON, it raises a `SyntaxError` that propagates up and terminates the Node.js process entirely.
Exploitation and Impact
The vulnerability was verified on version 4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Reproduction requires sending a malformed JSON request to the /mcp endpoint:
“`
POST /mcp HTTP/1.1
Content-Type: application/json
Mcp-Protocol-Version: 2025-11-25
{jsonrpc”:
“`
According to the advisory, this resulted in process termination in 3 out of 3 test runs with the error:
“`
exit_code=1
SyntaxError: Unexpected end of JSON input
at Server.
“`
The impact is a complete denial of service. An unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until an external supervisor restarts it. No authentication or privileges are required to exploit this vulnerability.
Affected Systems
The vulnerability affects:
- **Package**: @tsparticles/mcp-server (npm)
- **Affected versions**: All versions up to and including 4.3.0
- **Patched version**: 4.3.1
Patch and Mitigation
Version 4.3.1 fixes the vulnerability by wrapping JSON parsing in proper error handling. The patch, visible in commit 25fb70e7f527a91568adaef576570289083f243b, adds try-catch blocks around both the body reading and JSON parsing operations.
The fixed code now returns HTTP 400 responses with error messages for invalid JSON:
“`javascript
try {
parsedBody = body ? JSON.parse(body) : undefined;
} catch {
res.writeHead(400, { ‘Content-Type’: ‘application/json’ });
res.end(JSON.stringify({ error: ‘Invalid JSON’ }));
return;
}
“`
The process now remains alive after receiving malformed requests.
Recommendations
Organizations using @tsparticles/mcp-server should:
- Upgrade immediately to version 4.3.1 or later
- Review logs for evidence of exploitation attempts (repeated process crashes)
- Ensure external process supervisors are configured to restart the service if crashes occurred
- Consider implementing rate limiting or request validation at the network layer as defense-in-depth
The fix was merged via pull request #5875 on July 1, 2026.
