tsParticles MCP Server: Multiple DoS and Resource Exhaustion Vulnerabilities

Three separate vulnerabilities were discovered in @tsparticles/mcp-server HTTP mode: unbounded memory buffering leading to denial of service, unhandled JSON parsing exceptions that crash the process, and a shared transport instance that allows a single client to monopolize the server and deny access to other clients.

Disclosed 9 November 2026 · Record updated 10 November 2026

Impact

Unauthenticated remote attackers can cause denial of service through memory exhaustion, process crashes via malformed JSON, or by monopolizing the shared transport state to block legitimate clients from establishing MCP sessions.

Our coverage

A swarm of invisible wasps floods through an open gate, draining water from a reservoir until the pump gasps and stops, leaving other creatures stranded at the empty well.

Vulnerabilities

Three denial-of-service flaws found in tsParticles MCP server

Advisories published on 9 November 2026 say an unauthenticated attacker can exhaust memory, crash the process or lock out every other client.

10 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-447x-qqwf-m7xq
github.comhttps://github.com/advisories/GHSA-4p8p-pjpq-2w7h
github.comhttps://github.com/advisories/GHSA-h7c4-q426-7jh9