| Package | Affected versions | Patched versions |
|---|---|---|
| msgpack5 | < 6.1.0 | 6.1.0 |
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free