GHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

Summary

The HTTP mode of @tsparticles/mcp-server buffers every incoming request body chunk in an in-memory Buffer[] array with no size limit before calling JSON.parse, in the POST /mcp handler at src/index.ts lines 399-407. An unauthenticated remote attacker can stream an arbitrarily large body and exhaust Node.js process memory, causing a Denial of Service. The official Docker image runs HTTP mode on 0.0.0.0 port 3000 by default.

Mitigation

A suggested patch tracks cumulative received bytes against a maxRequestBodyBytes threshold of 1 MB (1024 * 1024) and destroys the request when it is exceeded. The source does not state a released fixed version.

Related items

• MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
• HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database