CVE-2026-107300

Published: Ott 08, 2026 Last Modified: Ott 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

674

Uncontrolled Recursion

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality
Potential Impacts:
Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/mcollina/msgpack5/commit/77fbef144d05def…
https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7…
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/security/advisories/GH…
https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9