GHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary

The HTTP mode of @tsparticles/mcp-server parses POST /mcp request bodies with JSON.parse() outside any request-local error handling. A single malformed JSON request makes the async handler throw and terminates the Node.js process, which the author verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. An unauthenticated remote attacker can take the MCP service offline until an external supervisor restarts it.

Mitigation

Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON. The source recommends wrapping request parsing in a local try/catch and returning a bounded HTTP 400 response such as {"error":"Invalid JSON"}, with the process remaining alive after malformed requests.

Related items

• MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
• HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database