GitHub Advisoryadvisory · npm

GHSA-5x5g-h9x8-2fh9 msgpack5: Many buffered values can exhaust the streaming decoder stack

HIGH Published 2026-10-08 Modified 2026-10-08 Official page ↗
Aliases
CVE-2026-107300
Ecosystem
npm
Packages
msgpack5
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2026-10-08

Affected packages

• npm msgpack5: < 6.1.0 → fixed in 6.1.0

Description

Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated values iteratively with constant call-stack depth. Workarounds Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.

Related

Alias · CVE (1)

  • CVE-2026-107300 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References