{"affected":[{"product":"tsparticles","source":"CNA: GitHub_M","vendor":"tsparticles","versions":[{"status":"affected","version":"< 4.3.1"}]},{"product":"mcp-server","source":"CNA: GitHub_M","vendor":"@tsparticles","versions":[{"status":"affected","version":"< 4.3.1"}]},{"ecosystem":"npm","packageName":"@tsparticles/mcp-server","product":"@tsparticles/mcp-server","source":"GitHub GHSA-447x-qqwf-m7xq","vendor":"","versions":[{"status":"affected","version":"<= 4.3.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-63655","cwes":["CWE-400"],"description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.","epss":{"date":"2026-11-05","percentile":0.37519,"score":0.00431},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794000738733,"publishedAt":1793829710183,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/pull/5875"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/pull/5875"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-447x-qqwf-m7xq","text":"@tsparticles/mcp-server (npm): GitHub reports patched versions 4.3.1. Check the advisory for the affected release branch.","url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"}],"revision":"5e2ba87ba2a095e0872df9636838ba5aa39ef264e21c3453294413a017c393d0","sources":[{"modifiedAt":1793909943619,"name":"CNA: GitHub_M","retrievedAt":1793913856823,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63655"},{"modifiedAt":1794000738733,"name":"NVD","retrievedAt":1794010971498,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63655"},{"modifiedAt":1784305774000,"name":"GitHub Security Advisories","retrievedAt":1794006909903,"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913858707,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63655"}],"ssvc":{"assessedAt":1793909923794,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS","updatedAt":1794010971498}