{"id":"CVE-2026-107300","published":"2026-10-08T17:17:16.000","lastModified":"2026-10-08T20:48:36.970","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-674"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9","tags":[]}],"exploitRefs":[{"url":"https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9","tags":[]}],"hasPoc":true,"ai":{"summary":"The msgpack5 library has a recursive streaming decoder that can be exhausted by sending many small valid MessagePack values in a single chunk, leading to JavaScript call stack overflow and process interruption. This affects applications using the library for message processing.","exploitability":"Exploitation is relatively straightforward as it requires only sending a specially crafted chunk with many small values to trigger the recursive calls, with no authentication or complex preconditions needed.","blast_radius":"The impact could be significant across applications that use msgpack5 for streaming message processing, potentially causing widespread service disruption and denial of service.","remediation":"Upgrade to version 6.1.0 or later to fix the recursive call stack exhaustion issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","streaming","javascript","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:36.660Z"}}