Kurz gesagt
- CVE-2026-107300 ist eine Schwachstelle (HOCH (CVSS 7.5)) in msgpack5.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.43%, höher als bei 37.1% aller Schwachstellen.
- Abhilfe: auf 6.1.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| msgpack5 npm | < 6.1.0
| 6.1.0
|
Description
Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
NVD description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free