Denial of Service Vulnerability in tsParticles Library by tsparticles

CVE-2026-63655

What is CVE-2026-63655?

The tsParticles library, widely utilized for creating customizable particle animations, contains a vulnerability in its HTTP mode. Versions prior to 4.3.1 allow remote attackers to send unauthenticated POST requests that accumulate request-body chunks in memory without a size limit. This could lead to excessive memory consumption, resulting in a Denial of Service where the Node.js process may terminate unexpectedly. It is crucial for users to upgrade to version 4.3.1 to mitigate the risk, particularly if they are using the official Docker configuration that exposes the service publicly.

References