GitHub Advisoryadvisory · npm

GHSA-24ch-f2g6-9hhh msgpack5: Deeply nested input can exhaust the decoder stack

MEDIUM Published 2026-10-08 Modified 2026-10-08 Official page ↗
Aliases
CVE-2026-107298
Ecosystem
npm
Packages
msgpack5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-674
Reviewed
2026-10-08

Affected packages

• npm msgpack5: < 6.1.0 → fixed in 6.1.0

Description

Impact The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler. Patches The decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option. Workarounds Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.

Related

Alias · CVE (1)

  • CVE-2026-107298 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References