GitHub Advisoryadvisory · npm

GHSA-26wq-p25c-j6fv msgpack5: Reserved byte can cause unbounded stream buffering

MEDIUM Published 2026-10-08 Modified 2026-10-08 Official page ↗
Aliases
CVE-2026-107299
Ecosystem
npm
Packages
msgpack5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-228
Reviewed
2026-10-08

Affected packages

• npm msgpack5: < 6.1.0 → fixed in 6.1.0

Description

Impact The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors. Workarounds Reject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.

Related

Alias · CVE (1)

  • CVE-2026-107299 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability

Weakness · CWE (1)

  • CWE-228 Improper Handling of Syntactically Invalid Structure weakness

References