{"data":{"id":"4e248872-a22e-400f-bc04-f483c364859a","title":"GHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients","summary":"The HTTP mode of @tsparticles/mcp-server, verified on v4.3.0 (commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c) and still present in v4.3.1 and current main, reuses one stateful StreamableHTTPServerTransport for all clients. An unauthenticated client whose initialize request arrives first claims that shared state, and later clients receive HTTP 400 \"Server already initialized\" until the process restarts. The first session stays functional while new clients are denied service.","solution":"Create a transport per session or maintain a bounded session-id-to-transport map. Do not reuse one stateful transport instance for all HTTP clients.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-h7c4-q426-7jh9","publishedAt":"2026-11-09T21:14:51.000Z","cveId":"CVE-2026-76893","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["@tsparticles/mcp-server@< 4.3.2 (fixed: 4.3.2)"],"affectedPackageNames":["@tsparticles/mcp-server"],"affectedPackageRefs":["npm:@tsparticles/mcp-server"],"affectedVendors":[],"affectedVendorsRaw":["tsParticles MCP server","@tsparticles/mcp-server","MCP (Model Context Protocol)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00291,"epssCheckedAt":"2026-11-10T00:11:21.739Z","kevDateAdded":null,"advisoryAliases":["GHSA-h7c4-q426-7jh9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-11-09T21:14:51.000Z","fixReleasedAt":"2026-07-10T10:30:22.675Z","daysToFix":-122,"fixCheckedAt":"2026-11-10T00:11:47.887Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@tsparticles/mcp-server","fixedVersion":"4.3.2","matchedVersion":"4.3.2","fixReleasedAt":"2026-07-10T10:30:22.675Z","daysToFix":-122,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-11-10T00:11:47.885Z"}]}}