Threats tagged 'ghsa-4p8p-pjpq-2w7h'

## Summary The HTTP mode of `@tsparticles/mcp-server` parses incoming `/mcp` request bodies with `JSON.parse()` outside a request-local error boundary. A single malformed JSON request causes the async request handler to throw and terminates the Node.js process. This was verified on `v4.3.0` at commit `0266d469aa2d719cb66a9c6bf09aded4186ec17c`. Version `4.3.1` appears to fix this by returning HTTP 400 for invalid JSON. ## Affected Code The vulnerable handler is: if (req.method === "POST" && req.url === "/mcp") { const body = await new Promise<string>((resolve, reject) => { const chunks: Buffer[] = []; req.on("data", (chunk) => chunks.push(Buffer.from(chunk))); req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8"))); req.on("error", reject); }); const parsedBody = body ? JSON.parse(body) : undefined; await transport.handleRequest(req, res, parsedBody); } The `JSON.parse()` call is not wrapped in `try/catch`. ## Reproduction Start the HTTP server and send this malformed request: POST /mcp HTTP/1.1 Content-Type: application/json Mcp-Protocol-Version: 2025-11-25 {"jsonrpc": Observed result in 3 out of 3 runs: exit_code=1 SyntaxError: Unexpected end of JSON input at Server.<anonymous> (integrations/mcp-server/src/index.ts:407:38) ## Impact An unauthenticated remote attacker can terminate the exposed MCP process with a single malformed request. The service remains unavailable until restarted by an external supervisor. ## Recommendation Wrap request parsing in a local `try/catch` and return a bounded HTTP 400 response such as: {"error":"Invalid JSON"} The process should remain alive after malformed requests.