CVE-2026-76892: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

November 9, 2026

The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse() outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process.

This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON.

References

github.com/advisories/GHSA-4p8p-pjpq-2w7h
github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b
github.com/tsparticles/tsparticles/pull/5875
github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h
nvd.nist.gov/vuln/detail/CVE-2026-76892

Code Behaviors & Features

Detect and mitigate CVE-2026-76892 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →