Kurz gesagt
- CVE-2026-107297 ist eine Schwachstelle (MITTEL (CVSS 5.9)) in msgpack5.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.39%, höher als bei 33.2% aller Schwachstellen.
- Abhilfe: auf 6.1.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| msgpack5 npm | < 6.1.0
| 6.1.0
|
Description
Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
NVD description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free