CVE-2026-107297
MediumCVSS 5.9Summary
In msgpack5 before 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop.
Risk Assessment
An attacker can cause CPU exhaustion and block the event loop, leading to denial of service.
Recommendation
Update msgpack5 to version 6.1.0 or later to address this issue.
Other vulnerabilities in msgpack5
See all- CVE-2026-107301Medium
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally.
- CVE-2026-107300High
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
- CVE-2026-107299Medium
msgpack5 before 6.1.0 treats the reserved byte 0xc1 as incomplete input instead of invalid. When a stream begins with 0xc1, subsequent data remains buffered while waiting for bytes that cannot make the value valid, allowing a remote peer to exhaust memory.
- CVE-2026-107298Medium
msgpack5 before 6.1.0 has no nesting-depth limit for arrays and maps, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler.
- CVE-2026-107296Low
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.
Original NVD description (English source)
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS