{"data":{"id":"f6934e43-ddfc-43fa-8555-add58058ba04","title":"GHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS","summary":"The HTTP mode of @tsparticles/mcp-server buffers every incoming request body chunk in an in-memory Buffer[] array with no size limit before calling JSON.parse, in the POST /mcp handler at src/index.ts lines 399-407. An unauthenticated remote attacker can stream an arbitrarily large body and exhaust Node.js process memory, causing a Denial of Service. The official Docker image runs HTTP mode on 0.0.0.0 port 3000 by default.","solution":"A suggested patch tracks cumulative received bytes against a maxRequestBodyBytes threshold of 1 MB (1024 * 1024) and destroys the request when it is exceeded. The source does not state a released fixed version.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-447x-qqwf-m7xq","publishedAt":"2026-11-09T21:10:46.000Z","cveId":"CVE-2026-63655","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["@tsparticles/mcp-server@< 4.3.1 (fixed: 4.3.1)"],"affectedPackageNames":["@tsparticles/mcp-server"],"affectedPackageRefs":["npm:@tsparticles/mcp-server"],"affectedVendors":[],"affectedVendorsRaw":["@tsparticles/mcp-server","MCP server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00431,"epssCheckedAt":"2026-11-10T00:11:21.729Z","kevDateAdded":null,"advisoryAliases":["GHSA-447x-qqwf-m7xq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-11-09T21:10:46.000Z","fixReleasedAt":"2026-07-01T11:13:03.709Z","daysToFix":-131,"fixCheckedAt":"2026-11-10T00:11:48.080Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@tsparticles/mcp-server","fixedVersion":"4.3.1","matchedVersion":"4.3.1","fixReleasedAt":"2026-07-01T11:13:03.709Z","daysToFix":-131,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-11-10T00:11:48.076Z"}]}}