All vulnerabilities
CVE-2026-107299GHSA-26wq-p25c-j6fv

msgpack5: Reserved byte can cause unbounded stream buffering

mcollina msgpack5npmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.1.0Fixed versionGitHub
Published8 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 6.1.0msgpack5, npmGitHubnpm install msgpack5@6.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.

Patches

The decoder now rejects 0xc1 as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.

Workarounds

Reject 0xc1 before streaming input to msgpack5, and enforce stream byte and time limits.

Text from GitHub Advisory Database

Affected versions 3

  • msgpack5, npm< 6.1.0GitHub
  • msgpack5affected: < 6.1.0CVE List
  • msgpack5, npmfrom first release, fixed in 6.1.0OSV

References 4