CVE-2026-107297 in msgpack5
Summary
by MITRE • 10/08/2026
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The msgpack5 library serves as a robust implementation of the MessagePack v5 serialization protocol for both Node.js environments and web browsers, facilitating efficient binary data exchange between systems. A critical performance vulnerability was identified within the streaming decoder component prior to version 6.1.0, specifically affecting how incomplete array or map structures are handled during multi-chunk transmission scenarios. This flaw stems from an inefficient parsing strategy where the decoder fails to maintain state across chunk boundaries for complex nested containers, leading to redundant processing of data that has already been partially decoded.
The technical root cause lies in the lack of persistent context retention within the streaming parser when handling incomplete MessagePack containers such as arrays or maps. When a remote peer transmits valid but fragmented binary data by splitting one logical container across multiple small network chunks, the decoder does not preserve the progress made on previously received segments. Instead, upon receiving each new chunk, the system restarts the parsing process from the beginning of the incomplete structure. This behavior results in the repeated decoding and processing of elements that were already successfully parsed in prior iterations, creating a compounding effect as more chunks arrive.
This architectural inefficiency leads to severe operational impacts characterized by quadratic CPU usage relative to the number of chunks received. As the volume of incoming data increases, the computational overhead grows exponentially rather than linearly, causing significant resource exhaustion on the host system. In Node.js environments, which rely heavily on a single-threaded event loop for handling asynchronous operations, this excessive CPU consumption blocks the event loop entirely. Consequently, other pending I/O operations, timers, and network requests are delayed or stalled, effectively rendering the application unresponsive to legitimate user traffic or internal service calls until the parsing completes or times out.
From a security perspective, this vulnerability represents a classic Denial of Service vector exploitable by remote attackers who can control the fragmentation pattern of transmitted data. The attack aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-770, Allocation of Resources Without Limits or Throttling. In terms of adversary tactics, this behavior mirrors techniques found in MITRE ATT&CK under resource hijacking, where an attacker aims to degrade service availability by consuming excessive computational resources through crafted input that triggers inefficient algorithmic complexity.
To mitigate the risk associated with this vulnerability, organizations must ensure that all instances of msgpack5 are upgraded to version 6.1.0 or later, which implements a corrected parsing logic capable of maintaining state across chunk boundaries and avoiding redundant processing. For systems unable to immediately upgrade, implementing input validation mechanisms such as maximum payload size limits can help restrict the impact by preventing excessively large or fragmented messages from reaching the parser. Additionally, deploying rate limiting on incoming connections may reduce the likelihood of sustained resource exhaustion attacks targeting this specific implementation flaw.