{"id":"CVE-2026-107300","aliases":["AZL-106851","CLSA-2026-1791806348","CLSA-2026-1793302953","EUVD-2026-95111","GHSA-5x5g-h9x8-2fh9"],"status":"published","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00426,"percentile":0.37356,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-10-08T17:11:13Z","modified":"2026-10-30T02:15:06Z","fixes":[{"ecosystem":"npm","package":"msgpack5","fixed_in":["6.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-tuxcare.0"},{"fixed":"4.5.1-tuxcare.1"}]}],"versions":["4.5.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"msgpack5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-tuxcare.0"},{"fixed":"3.6.1-tuxcare.1"}]}],"versions":["3.6.1"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"msgpack5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]}],"products":[{"vendor":"mcollina","product":"msgpack5"}],"references":[{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-5x5g-h9x8-2fh9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107300","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107300.json","tags":["advisory"]},{"url":"https://github.com/mcollina/msgpack5","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107300","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:11:13.552Z","modified":"2026-10-08T17:52:48.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95111","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:11:13Z","modified":"2026-10-08T17:52:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:28.108203Z"}],"ghsa":[{"id":"GHSA-5x5g-h9x8-2fh9","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"### Impact\n\nThe streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.\n\n### Patches\n\nThe streaming decoder now drains concatenated values iteratively with constant call-stack depth.\n\n### Workarounds\n\nLimit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.","status":"published","published":"2026-10-08T17:40:06Z","modified":"2026-10-08T17:40:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107300","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:16Z","modified":"2026-10-08T20:48:36.97Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107300","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:11:13.552Z","modified":"2026-10-28T02:31:00.036249564Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-5x5g-h9x8-2fh9","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"### Impact\n\nThe streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.\n\n### Patches\n\nThe streaming decoder now drains concatenated values iteratively with constant call-stack depth.\n\n### Workarounds\n\nLimit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.","status":"published","published":"2026-10-08T17:40:06Z","modified":"2026-10-08T18:00:08.893076738Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"AZL-106851","title":"CVE-2026-107300 affecting package msgpack 3.3.0-1","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.","status":"published","published":"2026-10-08T17:17:16Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CLSA-2026-1791806348","title":"TuxCare security update for msgpack5 (5 CVEs)","description":"TuxCare rebuilt msgpack5 to address 5 CVEs. Fixed in 4.5.1-tuxcare.1.","status":"published","published":"2026-10-12T11:59:08Z","modified":"2026-10-23T13:58:13.881280526Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793302953","title":"TuxCare security update for msgpack5 (7 CVEs)","description":"TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 3.6.1-tuxcare.1.","status":"published","published":"2026-10-29T20:42:34Z","modified":"2026-10-30T02:15:06.130856267Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}