GitHub Advisoryadvisory · npm

GHSA-gcx5-hxj7-gpqq msgpack5: Quadratic parsing in the streaming decoder

MEDIUM Published 2026-10-08 Modified 2026-10-08 Official page ↗
Aliases
CVE-2026-107297
Ecosystem
npm
Packages
msgpack5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407
Reviewed
2026-10-08

Affected packages

• npm msgpack5: < 6.1.0 → fixed in 6.1.0

Description

Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives. Workarounds Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.

Related

Alias · CVE (1)

  • CVE-2026-107297 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

References