{"id":7196,"date":"2026-11-11T13:23:23","date_gmt":"2026-11-11T13:23:23","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-76892-tsparticles-mcp-server-json-crash"},"modified":"2026-11-11T13:23:23","modified_gmt":"2026-11-11T13:23:23","slug":"cve-2026-76892-tsparticles-mcp-server-json-crash","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-76892-tsparticles-mcp-server-json-crash","title":{"rendered":"CVE-2026-76892: Malformed JSON Crashes tsParticles MCP Server, Causing Denial of Service"},"content":{"rendered":"\n

Vulnerability Overview<\/h2>\n\n\n\n

CVE-2026-76892 is a high-severity denial-of-service vulnerability in the @tsparticles\/mcp-server package, a TypeScript library component for creating particle animations. The flaw allows unauthenticated remote attackers to crash the entire Node.js process by sending a single malformed JSON request to the HTTP endpoint.<\/p>\n\n\n\n

The vulnerability affects versions prior to 4.3.1 and has been assigned a CVSS v4 score of 8.7.<\/p>\n\n\n\n

Technical Details<\/h2>\n\n\n\n

The vulnerability exists in the HTTP mode POST \/mcp handler located in `integrations\/mcp-server\/src\/index.ts`. According to the security advisory, the code calls `JSON.parse()` on incoming request bodies without wrapping the operation in a request-local error boundary or try-catch block.<\/p>\n\n\n\n

The vulnerable code pattern is:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

const body = await new Promise((resolve, reject) => {<\/p>\n\n\n\n

const chunks: Buffer[] = [];<\/p>\n\n\n\n

req.on(“data, (chunk) => chunks.push(Buffer.from(chunk)));<\/p>\n\n\n\n

req.on(end, () => resolve(Buffer.concat(chunks).toString(utf8″)));<\/p>\n\n\n\n

req.on(“error, reject);<\/p>\n\n\n\n

});<\/p>\n\n\n\n

const parsedBody = body ? JSON.parse(body) : undefined;<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

When `JSON.parse()` encounters malformed JSON, it raises a `SyntaxError` that propagates up and terminates the Node.js process entirely.<\/p>\n\n\n\n

Exploitation and Impact<\/h2>\n\n\n\n

The vulnerability was verified on version 4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Reproduction requires sending a malformed JSON request to the \/mcp endpoint:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

POST \/mcp HTTP\/1.1<\/p>\n\n\n\n

Content-Type: application\/json<\/p>\n\n\n\n

Mcp-Protocol-Version: 2025-11-25<\/p>\n\n\n\n

{jsonrpc”:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

According to the advisory, this resulted in process termination in 3 out of 3 test runs with the error:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

exit_code=1<\/p>\n\n\n\n

SyntaxError: Unexpected end of JSON input<\/p>\n\n\n\n

at Server. (integrations\/mcp-server\/src\/index.ts:407:38)<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

The impact is a complete denial of service. An unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until an external supervisor restarts it. No authentication or privileges are required to exploit this vulnerability.<\/p>\n\n\n\n

Affected Systems<\/h2>\n\n\n\n

The vulnerability affects:<\/p>\n\n\n\n