Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

tsParticles HTTP server can block new clients

CVE-2026-76893 · published today
Summary

The tsParticles library’s HTTP mode can be taken over by the first user who connects without proper identification, stopping any later users from starting their own sessions until the server is restarted. This only affects the tsParticles core package and its MCP server component. Update to version 4.3.2 or later to prevent the blockage.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tsparticles tsparticles < 4.3.2
@tsparticles mcp-server < 4.3.2
Original advisory text
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.9 Medium
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-76893 · NVD
CVE-2026-76893 · MITRE
Track software like this
Free during beta