{"affected":[{"product":"tsparticles","source":"CNA: GitHub_M","vendor":"tsparticles","versions":[{"status":"affected","version":"< 4.3.1"}]},{"product":"mcp-server","source":"CNA: GitHub_M","vendor":"@tsparticles","versions":[{"status":"affected","version":"< 4.3.1"}]}],"cveId":"CVE-2026-76892","cwes":["CWE-248"],"description":"tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.7,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793834278557,"publishedAt":1793830453918,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/pull/5875"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/pull/5875"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h"}],"remediation":[],"revision":"290ddd6425548a5396006033c9545f5d6e9ae8cab105d1a1ac8d72768743a4cf","sources":[{"modifiedAt":1793830453918,"name":"CNA: GitHub_M","retrievedAt":1793833920657,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76892"},{"modifiedAt":1793834278557,"name":"NVD","retrievedAt":1793838309625,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76892"}],"ssvc":null,"status":"published","title":"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process","updatedAt":1793838309625}