{"id":"CVE-2026-107298","aliases":["AZL-106860","CLSA-2026-1791806348","CLSA-2026-1793302953","EUVD-2026-95109","GHSA-24ch-f2g6-9hhh"],"status":"published","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00372,"percentile":0.3154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-10-08T17:08:22Z","modified":"2026-10-30T02:15:06Z","fixes":[{"ecosystem":"npm","package":"msgpack5","fixed_in":["6.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-tuxcare.0"},{"fixed":"4.5.1-tuxcare.1"}]}],"versions":["4.5.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-tuxcare.0"},{"fixed":"3.6.1-tuxcare.1"}]}],"versions":["3.6.1"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]}],"products":[{"vendor":"mcollina","product":"msgpack5"}],"references":[{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-24ch-f2g6-9hhh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107298","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107298.json","tags":["advisory"]},{"url":"https://github.com/mcollina/msgpack5","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107298","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:08:22.022Z","modified":"2026-10-09T11:39:42.593Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95109","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:08:22Z","modified":"2026-10-09T11:39:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:25.459601Z"}],"ghsa":[{"id":"GHSA-24ch-f2g6-9hhh","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"### Impact\n\nThe decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.\n\n### Patches\n\nThe decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option.\n\n### Workarounds\n\nReject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.","status":"published","published":"2026-10-08T17:39:51Z","modified":"2026-10-08T17:39:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107298","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:15.703Z","modified":"2026-10-09T12:17:07.863Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107298","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:08:22.022Z","modified":"2026-10-28T02:30:32.650700842Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-24ch-f2g6-9hhh","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"### Impact\n\nThe decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.\n\n### Patches\n\nThe decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option.\n\n### Workarounds\n\nReject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.","status":"published","published":"2026-10-08T17:39:51Z","modified":"2026-10-08T18:00:09.700213613Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"AZL-106860","title":"CVE-2026-107298 affecting package msgpack 3.3.0-1","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:15Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CLSA-2026-1791806348","title":"TuxCare security update for msgpack5 (5 CVEs)","description":"TuxCare rebuilt msgpack5 to address 5 CVEs. Fixed in 4.5.1-tuxcare.1.","status":"published","published":"2026-10-12T11:59:08Z","modified":"2026-10-23T13:58:13.881280526Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793302953","title":"TuxCare security update for msgpack5 (7 CVEs)","description":"TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 3.6.1-tuxcare.1.","status":"published","published":"2026-10-29T20:42:34Z","modified":"2026-10-30T02:15:06.130856267Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}