CVE-2026-76893: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

November 9, 2026

The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions.

This was verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. The same singleton transport pattern is still present in v4.3.1 and current main.

References

github.com/advisories/GHSA-h7c4-q426-7jh9
github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896
github.com/tsparticles/tsparticles/pull/5888
github.com/tsparticles/tsparticles/security/advisories/GHSA-h7c4-q426-7jh9
nvd.nist.gov/vuln/detail/CVE-2026-76893

Code Behaviors & Features

Detect and mitigate CVE-2026-76893 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →