p PatchFirst

CVE-2026-107297

CVE-2026-107297 · msgpack5: Quadratic parsing in the streaming decoder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.

CVSS 5.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • msgpack5

    Versions
    • < 6.1.0: Affected

    No fix published

  • msgpack5 npm

    Affected ranges
    • SEMVER: < 6.1.0

    Update to 6.1.0

Original sources

Check your server →