@Tsparticles/Mcp-Server - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/@tsparticles/mcp-server/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 07:31:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgtsparticles: Remote Denial of Service via Unbounded HTTP Request Body Bufferinghttps://feed.craftedsignal.io/briefs/2026-11-tsparticles-mcp-dos/Wed, 11 Nov 2026 07:31:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-tsparticles-mcp-dos/The @tsparticles/mcp-server HTTP handler fails to restrict the size of incoming request bodies, allowing an unauthenticated attacker to cause OOM-driven process termination via a large POST request.The HTTP server mode of @tsparticles/mcp-server is vulnerable to a Denial of Service (DoS) attack. The application's /mcp POST endpoint accumulates all incoming request body chunks into an in-memory Buffer[] array without enforcing size limits or checking the Content-Length header. An attacker can stream an arbitrarily large body, exhausting the Node.js process memory and triggering an OOM-killer termination. The default configuration exposes this endpoint on all network interfaces (0.0.0.0:3000) when deployed via the official Docker image.

Impact

Successful exploitation leads to complete service unavailability of the mcp-server instance. The vulnerability allows an unauthenticated remote attacker to force an OOM-kill of the containerized process. No credentials are required, and the impact is limited to resource exhaustion rather than direct unauthorized data access or code execution.

Recommendation

  • Update or patch the integrations/mcp-server/src/index.ts file to implement a maximum body size limit during the request stream processing.
  • Implement a check for the Content-Length header before consuming the request body.
  • If immediate patching is not possible, place a reverse proxy or Web Application Firewall (WAF) in front of the service to enforce request body size limits and restrict access to the /mcp endpoint.
  • Monitor container memory usage metrics for abnormal spikes associated with requests to the /mcp endpoint.
]]>highadvisorydenial-of-servicewebserveroomnodejs