GHSA-26wq-p25c-j6fv: Medium severity npm/msgpack5 vulnerability
Impact
The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.
Patches
The decoder now rejects 0xc1 as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.
Workarounds
Reject 0xc1 before streaming input to msgpack5, and enforce stream byte and time limits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Compensating control
Reject the reserved MessagePack byte 0xc1 before streaming input to msgpack5.
- Compensating control
Enforce stream byte and time limits for msgpack5 streaming input.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to memory exhaustion?
Deployments using msgpack5 streaming decoders on input an attacker can control are exposed. The issue is triggered when the reserved MessagePack byte 0xc1 appears at the beginning of the decoder stream.
What does an attacker need to do to exploit this?
An attacker needs to supply a stream beginning with 0xc1. The decoder treats that byte as incomplete input and retains all subsequent data while waiting for input that cannot make the value valid, which can exhaust memory.
What should be done if an update cannot be applied immediately?
Reject 0xc1 before passing streaming input to msgpack5, and enforce limits on both stream size and stream duration. These measures reduce the ability to cause unbounded buffering.
Which release contains the fix?
The fix is available in msgpack5 v6.1.0. It rejects 0xc1 as invalid input, and streaming decoders release buffered input and stop after unrecoverable decoding errors.