GHSA-5x5g-h9x8-2fh9: High severity npm/msgpack5 vulnerability
Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/msgpack5to a version that resolves this vulnerability.Fixed in 6.1.0 - Compensating control
Limit the number of MessagePack values accepted in a single chunk, or split large batches before passing them to the decoder stream.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments that use the msgpack5 streaming decoder and accept chunks containing concatenated MessagePack values are exposed. A chunk with many small, valid values can interrupt the affected process or stream.
What does an attacker need to do to trigger the issue?
An attacker needs to supply a single chunk containing many small valid MessagePack values to the streaming decoder. No authentication, user interaction, or special conditions are indicated by the provided severity vector.
What can be done if updating is not immediately possible?
Limit the number of MessagePack values accepted in each chunk, or split large batches before passing them to the decoder stream. These measures reduce the recursive processing that exhausts the JavaScript call stack.
What change addresses the problem?
The patched streaming decoder drains concatenated values iteratively, using constant call-stack depth instead of recursively invoking itself for each remaining value in a chunk. The referenced release tag is v6.1.0.