All vulnerabilities
CVE-2026-107298GHSA-24ch-f2g6-9hhh

msgpack5: Deeply nested input can exhaust the decoder stack

mcollina msgpack5npmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.1.0Fixed versionGitHub
Published8 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 6.1.0msgpack5, npmGitHubnpm install msgpack5@6.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.

Patches

The decoder now limits nesting depth to 100 by default and throws Maximum decode depth exceeded. Applications can configure the limit with the maxDepth option.

Workarounds

Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.

Text from GitHub Advisory Database

Affected versions 3

  • msgpack5, npm< 6.1.0GitHub
  • msgpack5affected: < 6.1.0CVE List
  • msgpack5, npmfrom first release, fixed in 6.1.0OSV

References 4