CVE-2026-107300 — msgpack5 is a msgpack v5 implementation for node.js and the browser.
Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
CVSS v3.1 base metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHigh severity
Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.
AV
Network
Attack Vector
AC
Low
Attack Complexity
PR
None
Privileges Required
UI
None
User Interaction
S
Unchanged
Scope
C
None
Confidentiality
I
None
Integrity
A
High
Availability
Affected
- Vendor
- npm
- Product
- msgpack5
Versions
- pkg:npm/msgpack5 < 6.1.0
Stated as the source expressed them.
References
- advisory[email protected]https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba
- advisory[email protected]https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
- advisory[email protected]https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9
- advisoryOSV GHSA-5x5g-h9x8-2fh9https://osv.dev/vulnerability/GHSA-5x5g-h9x8-2fh9
- vendorOSV packagehttps://github.com/mcollina/msgpack5
Related threats
same CWE or vendorCVE-2026-19498 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial…
CVE-2026-19498 · 3h ago
CVE-2026-107392 — music-metadata is a metadata parser for audio and video media files.
CVE-2026-107392 · 4h ago
CVE-2026-107391 — music-metadata is a metadata parser for audio and video media files.
CVE-2026-107391 · 4h ago
CVE-2026-107389 — music-metadata is a metadata parser for audio and video media files.
CVE-2026-107389 · 4h ago
CVE-2026-107388 — music-metadata is a metadata parser for audio and video media files.
CVE-2026-107388 · 5h ago
CVE-2026-107387 — music-metadata is a metadata parser for audio and video media files.
CVE-2026-107387 · 5h ago