CVE-2026-107298
msgpack5: Deeply nested input can exhaust the decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
msgpack5: Deeply nested input can exhaust the decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Record
CVE-2026-107298- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-95109
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Record
EUVD-2026-95109- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-24ch-f2g6-9hhh
msgpack5: Deeply nested input can exhaust the decoder stack
Impact
The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.
Patches
The decoder now limits nesting depth to 100 by default and throws Maximum decode depth exceeded. Applications can configure the limit with the maxDepth option.
Workarounds
Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.
- Record
GHSA-24ch-f2g6-9hhh- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Record
CVE-2026-107298- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
msgpack5: Deeply nested input can exhaust the decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Record
CVE-2026-107298- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVGHSA-24ch-f2g6-9hhh
msgpack5: Deeply nested input can exhaust the decoder stack
Impact
The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.
Patches
The decoder now limits nesting depth to 100 by default and throws Maximum decode depth exceeded. Applications can configure the limit with the maxDepth option.
Workarounds
Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.
- Record
GHSA-24ch-f2g6-9hhh- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVAZL-106860 No score
CVE-2026-107298 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Record
AZL-106860- Updated
- 2026-11-02
OSVCLSA-2026-1791806348 No score
TuxCare security update for msgpack5 (5 CVEs)
TuxCare rebuilt msgpack5 to address 5 CVEs. Fixed in 4.5.1-tuxcare.1.
- Record
CLSA-2026-1791806348- Updated
- 2026-11-02
OSVCLSA-2026-1793302953 No score
TuxCare security update for msgpack5 (7 CVEs)
TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 3.6.1-tuxcare.1.
- Record
CLSA-2026-1793302953- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
msgpack5npm |
before 6.1.0 | 6.1.0 |
msgpackAzure Linux:3 |
through 3.3.0-1 | None known |
msgpack5TuxCare:npm From an advisory covering 5 CVEs |
4.5.1-tuxcare.0 up to 4.5.1-tuxcare.1, plus listed versions 4.5.1 |
4.5.1-tuxcare.1 |
msgpack5TuxCare:npm From an advisory covering 7 CVEs |
3.6.1-tuxcare.0 up to 3.6.1-tuxcare.1, plus listed versions 3.6.1 |
3.6.1-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107298 is a medium vulnerability (CVSS 5.3) in Mcollina Msgpack5, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in msgpack5 6.1.0.
References
github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh
nvd.nist.gov/vuln/detail/CVE-2026-107298