tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

Summary The HTTP mode of @tsparticles/mcp-server parses incoming /mcp request bodies with JSON.parse outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process. This was verified on v4.3.0 at commit...

CVE-2026-76892

A flaw was found in @tsparticles/mcp-server. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a malformed JSON request to the HTTP server endpoint. Because the application fails to catch parsing errors when handling incoming requests, the invalid payload causes an...

PT-2026-137222

Name of the Vulnerable Software and Affected Versions tsParticles versions prior to 4.3.1 Description The HTTP mode of @tsparticles/mcp-server contains a flaw where JSON.parse is called outside a request-local error boundary within the POST '/mcp' endpoint. An unauthenticated user can send a...

CLEANSTART-2026-DS51960 Delete function fails to properly validate offsets when processing malformed JSON input

CVE-2026-32285 affects multiple packages. The Delete function fails to properly validate offsets when processing malformed JSON input. See references for individual vulnerability details...

CLEANSTART-2026-SW70852 Delete function fails to properly validate offsets when processing malformed JSON input

CVE-2026-32285 affects multiple packages. The Delete function fails to properly validate offsets when processing malformed JSON input. See references for individual vulnerability details...

CLEANSTART-2026-ZH33072 Delete function fails to properly validate offsets when processing malformed JSON input

CVE-2026-32285 affects multiple packages. The Delete function fails to properly validate offsets when processing malformed JSON input. See references for individual vulnerability details...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. We have addressed this vulnerability in our latest iFix for all versions. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable to improper encoding of non-finite floating-point values

Summary Vulnerability of Improper encoding related to Log4j library was addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by Improper Encoding of Output in Apache Log4j API (CVE-2026-49844)

Summary A security vulnerability CVE-2026-49844 has been identified in Apache Log4j API, a logging library used by applications, including IBM Engineering Lifecycle Optimization - Engineering Publishing. The vulnerability is caused by improper encoding of non-finite floating-point values NaN,...

CVE-2026-110672

A flaw was found in perl-Cpanel-JSON-XS. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key, or for a duplicate key. Duplicate keys are...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-49844).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This...

Security Bulletin: Vulnerability in Apache Log4j Core shipped in Tivoli Netcool/OMNIbus (CVE-2026-49844)

Summary The Netcool/Omnibus 'Administrator GUI' and 'Accelerated Event Notification GUI' desktop components use a version of Apache Log4j that contains a known vulnerability. This has been addressed. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j (CVE-2026-49844)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output

Summary IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

Security Bulletin: IBM Guardium Key Lifecycle Manager is affected by a security vulnerability (CVE-2026-49844)

Summary Security vulnerability has been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. Th...

AlmaLinux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1784624635)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784624635 advisory. - Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

Rocky Linux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1784624635)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784624635 advisory. - Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is no...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to Improper Encoding due to Apache Log4j (CVE-2026-49844)

Summary Apache Log4j is shipped with IBM Tivoli Netcool Impact as part of its logging infrasture. Information about a security vulnerability affecting Apache Log4j has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844

Summary IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values durin...