CVE-2026-76893mediumCWE-400

CVE-2026-76893: medium-severity vulnerability in tsparticles

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

Published · Updated

Follow this CVE+ Monitor tsparticles+ Monitor mcp-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
@tsparticles · mcp-servertsparticles · tsparticles
Related CVEs — tsparticles

In the same product, most dangerous first.

CVE-2026-63655HIGHtsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSEPSS 0.4%CVE-2026-76826HIGHtsParticles: Generated release notes can execute shell commands in the stable publish workflowEPSS 0.3%CVE-2026-76892HIGHtsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processEPSS 0.3%