CVE-2026-76892
Description
A flaw was found in @tsparticles/mcp-server. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending a malformed JSON request to the HTTP server endpoint. Because the application fails to catch parsing errors when handling incoming requests, the invalid payload causes an unhandled exception that crashes the server process, leaving the service unavailable.
Statement
This vulnerability is rated as Important because unauthenticated remote attackers can trigger an immediate denial of service by causing the server process to terminate without requiring valid credentials or specialized user interaction. Because the flaw allows complete loss of service availability over the network, it poses an elevated risk compared to flaws requiring local privileges or complex setup. The affected npm package is not deployed by default in standard Red Hat Enterprise Linux runtime environments, restricting exposure to custom applications or specialized environments that explicitly expose this service.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
