CVE-2026-107300: msgpack5: Many buffered values can exhaust the streaming decoder stack
Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
Other sources
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Upgrade
Upgrade
msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Compensating control
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Applications using msgpack5 versions earlier than 6.1.0 that decode MessagePack data from a remote peer through the streaming decoder are exposed. Both Node.js and browser uses are within the stated product scope.
What does an attacker need to send to trigger the issue?
An attacker needs to be able to send a single input chunk containing many small, valid MessagePack values. No malformed MessagePack input is required; the decoder's recursive handling of remaining complete values causes call-stack growth proportional to the number of values.
What is the operational impact of successful exploitation?
Exhausting the JavaScript call stack can interrupt the affected process or stream, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
What version resolves the vulnerability?
Upgrade msgpack5 to version 6.1.0 or later. The issue is stated to affect versions prior to 6.1.0.