{"id":"CVE-2026-107302","published":"2026-10-08T18:17:19.100","lastModified":"2026-10-08T20:48:36.970","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph","tags":[]}],"exploitRefs":[{"url":"https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph","tags":[]}],"hasPoc":true,"ai":{"summary":"The msgpack5 library has a buffer over-read vulnerability where it reads a map32 header's length before validating the complete header is available, leading to unexpected RangeError exceptions instead of proper IncompleteBufferError handling. This can cause application crashes or unexpected termination when processing malformed data.","exploitability":"Exploitation requires sending a specially crafted truncated map32 header that triggers an out-of-bounds read, which may be moderately difficult to exploit directly but can reliably cause denial of service through unexpected application termination.","blast_radius":"The vulnerability affects applications using msgpack5 for data processing, potentially causing widespread service disruption when malformed data is received through network streams or file processing.","remediation":"Upgrade to version 6.1.0 or later to fix the out-of-bounds buffer read issue in msgpack5.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","buffer-overflow","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:31.400Z"}}