CVE-2026-107302: msgpack5: Truncated map32 headers throw an unexpected error
Impact
A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.
Patches
The decoder now validates the complete five-byte map32 header before reading its length and reports truncated input as IncompleteBufferError.
Workarounds
Require at least five bytes before decoding a value beginning with 0xdf, or catch RangeError and treat it as incomplete input only for truncated map32 headers.
Other sources
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Upgrade
Upgrade
msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Compensating control
Require at least five bytes before decoding a value beginning with 0xdf, or catch RangeError and treat it as incomplete input only for truncated map32 headers.
Event History
Frequently Asked Questions
Which applications are exposed to unexpected termination?
Applications using msgpack5 before 6.1.0 are exposed if they decode attacker-controlled or unreliable MessagePack streams and treat IncompleteBufferError as a signal to wait for more bytes. A truncated map32 header can instead raise an unhandled RangeError and terminate a request, stream, or worker.
What does an attacker need to trigger the issue?
An attacker only needs to cause the decoder to receive a truncated map32 header. No authentication or user interaction is required according to the supplied severity vector.
Is this an information disclosure issue?
No. The out-of-bounds read is checked by the buffer implementation, so it throws an error rather than exposing adjacent memory.
What should be done if an immediate upgrade is not possible?
Ensure decoding paths safely handle RangeError from malformed or incomplete input rather than allowing it to terminate the request, stream, or worker. Upgrade to msgpack5 6.1.0 when possible.