@tsparticles/mcp-server buffers unlimited request bodies, allowing remote DoS

Anyone can crash this animation library's server by sending huge data.

Summary

The HTTP mode of @tsparticles/mcp-server reads request bodies without a size limit, so an unauthenticated remote attacker can exhaust Node.js memory and stop the service. Versions 4.3.0 and older are affected, including the official Docker setup.

Affected when

mcp-server running in HTTP mode (default in the official Docker setup)

What to do

Update to version 4.3.1.

Products and platforms

@tsparticles/mcp-server
tsparticles

CVE IDs

CVE-2026-63655 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 22:01 UTC

First seen 2026-11-09 16:20 UTC