{"id":"CVE-2026-107299","aliases":["AZL-106848","CLSA-2026-1791806348","CLSA-2026-1793302953","EUVD-2026-95110","GHSA-26wq-p25c-j6fv"],"status":"published","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00389,"percentile":0.33423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-228"],"published":"2026-10-08T17:09:47Z","modified":"2026-10-30T02:15:06Z","fixes":[{"ecosystem":"npm","package":"msgpack5","fixed_in":["6.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-tuxcare.0"},{"fixed":"4.5.1-tuxcare.1"}]}],"versions":["4.5.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-tuxcare.0"},{"fixed":"3.6.1-tuxcare.1"}]}],"versions":["3.6.1"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]}],"products":[{"vendor":"mcollina","product":"msgpack5"}],"references":[{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-26wq-p25c-j6fv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107299","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107299.json","tags":["advisory"]},{"url":"https://github.com/mcollina/msgpack5","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107299","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:09:47.191Z","modified":"2026-10-09T15:15:00.98Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-95110","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:09:47Z","modified":"2026-10-09T15:15:00Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:25.010362Z"}],"ghsa":[{"id":"GHSA-26wq-p25c-j6fv","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"### Impact\n\nThe reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.\n\n### Patches\n\nThe decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.\n\n### Workarounds\n\nReject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.","status":"published","published":"2026-10-08T17:40:01Z","modified":"2026-10-08T17:40:02Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107299","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:15.85Z","modified":"2026-10-09T16:17:22.147Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107299","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:09:47.191Z","modified":"2026-10-28T02:30:56.016160767Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-26wq-p25c-j6fv","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"### Impact\n\nThe reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.\n\n### Patches\n\nThe decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.\n\n### Workarounds\n\nReject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.","status":"published","published":"2026-10-08T17:40:01Z","modified":"2026-10-08T18:00:08.901031374Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"AZL-106848","title":"CVE-2026-107299 affecting package msgpack 3.3.0-1","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:15Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CLSA-2026-1791806348","title":"TuxCare security update for msgpack5 (5 CVEs)","description":"TuxCare rebuilt msgpack5 to address 5 CVEs. Fixed in 4.5.1-tuxcare.1.","status":"published","published":"2026-10-12T11:59:08Z","modified":"2026-10-23T13:58:13.881280526Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793302953","title":"TuxCare security update for msgpack5 (7 CVEs)","description":"TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 3.6.1-tuxcare.1.","status":"published","published":"2026-10-29T20:42:34Z","modified":"2026-10-30T02:15:06.130856267Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}