# CVE-2026-76892

Malformed JSON in MCP POST can crash Node.js process causing service DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2026-76892
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-248
- Published: 2026-11-04

## Affected versions

- @tsparticles mcp-server: affected < 4.3.1
- tsparticles: affected < 4.3.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated malformed JSON POST to /mcp triggers a SyntaxError that terminates the Node.js process, causing denial-of-service and service outage.

## Action

Immediate action required

## Recommendation

Upgrade @tsparticles/mcp-server to v4.3.1+ and add JSON validation/error boundaries.

## References

- [other] https://github.com/tsparticles/tsparticles/security/advisories/GHSA-4p8p-pjpq-2w7h
- [other] https://github.com/tsparticles/tsparticles/pull/5875
- [other] https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.