Stateful Transport Vulnerability in tsParticles Library by tsparticles

CVE-2026-76893

What is CVE-2026-76893?

The tsParticles library, designed for customizable particle animations, has a vulnerability in its HTTP mode prior to version 4.3.2. This vulnerability arises from the reuse of a single, stateful StreamableHTTPServerTransport for multiple clients. An attacker can exploit this flaw by sending an initialization request as the first unauthenticated client, thereby claiming the shared transport state. As a result, subsequent clients encounter a 'Server already initialized' error, hindering their ability to establish sessions until the transport process is restarted. The first client's session remains unaffected, highlighting the need for an immediate update to version 4.3.2 to mitigate this issue.

References