CVE-2026-63655: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer[] array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (--port 3000 on 0.0.0.0), making this exploitable without any special configuration in containerized deployments.
References
- github.com/advisories/GHSA-447x-qqwf-m7xq
- github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b
- github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea
- github.com/tsparticles/tsparticles/pull/5875
- github.com/tsparticles/tsparticles/releases/tag/v4.3.1
- github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq
- nvd.nist.gov/vuln/detail/CVE-2026-63655
Code Behaviors & Features
Detect and mitigate CVE-2026-63655 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →