p PatchFirst

CVE-2026-107299

CVE-2026-107299 · msgpack5: Reserved byte can cause unbounded stream buffering

This page contains facts from public vulnerability sources. Check the original advisory before updating.

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.

CVSS 5.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • msgpack5

    Versions
    • < 6.1.0: Affected

    No fix published

  • msgpack5 npm

    Affected ranges
    • SEMVER: < 6.1.0

    Update to 6.1.0

Original sources

Check your server →