All vulnerabilities
CVE-2026-107300GHSA-5x5g-h9x8-2fh9

msgpack5: Many buffered values can exhaust the streaming decoder stack

mcollina msgpack5npmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.1.0Fixed versionGitHub
Published8 Oct 2026Updated 8 Oct 2026CVE List

What fixes it

  • 6.1.0msgpack5, npmGitHubnpm install msgpack5@6.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.

Patches

The streaming decoder now drains concatenated values iteratively with constant call-stack depth.

Workarounds

Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.

Text from GitHub Advisory Database

Affected versions 3

  • msgpack5, npm< 6.1.0GitHub
  • msgpack5affected: < 6.1.0CVE List
  • msgpack5, npmfrom first release, fixed in 6.1.0OSV

References 4