15 matches found
EUVD-2026-117156
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients...
GHSA-H7C4-Q426-7JH9 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This...
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This...
CVE-2026-76893
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893
The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable in versions prior to 4.3.2 . Due to a flaw in the HTTP mode , the server reuses a single stateful StreamableHTTPServerTransport for all clients. An unauthenticated client can claim this shared st...
PT-2026-137223
Name of the Vulnerable Software and Affected Versions @tsparticles/mcp-server versions prior to 4.3.2 Description The HTTP mode of the server reuses a single stateful StreamableHTTPServerTransport for every client. An unauthenticated client can claim the shared transport state by sending an initi...
tsParticles resource management error vulnerability
Versions of tsParticles prior to 4.3.2 and @tsParticles/mcp-server prior to 4.3.2 contain a resource management error vulnerability. This vulnerability arises because the HTTP mode of @tsParticles/mcp-server reuses the same stateful StreamableHTTPServerTransport for every client. Unauthenticated...
CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-25536
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...
CVE-2026-25536: Concurrent Execution using Shared Resource with Improper Synchronization
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...
CVE-2025-66414
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol MCP TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without...
CVE-2025-66414: Initialization of a Resource with an Insecure Default
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol MCP TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without...