CVE-2026-107299 in msgpack5
Summary
by MITRE • 10/08/2026
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The msgpack5 library serves as an implementation of the MessagePack v5 serialization format for Node.js and browser environments, facilitating efficient binary data exchange between systems. A critical vulnerability exists within the streaming decoder component prior to version 6.1.0, specifically concerning the handling of reserved byte values defined by the MessagePack specification. The protocol designates certain bytes as reserved or invalid, meaning they should never appear in a valid stream and must trigger an immediate error condition rather than being interpreted as partial data awaiting completion.
The technical flaw lies in how the decoder processes the specific reserved byte 0xc1 when it appears at the beginning of a message stream. Instead of recognizing this byte as an indicator of invalid input that warrants an immediate termination or error response, the implementation incorrectly treats it as incomplete input. This misclassification causes the decoder to enter a state where it continues buffering subsequent data in anticipation of future bytes that would theoretically complete a valid structure starting with 0xc1. Since no such completing sequence exists for this reserved byte under any valid MessagePack interpretation, the buffer grows indefinitely without ever resolving into a parseable object or throwing an exception.
This behavior creates a severe resource exhaustion vulnerability, commonly categorized as CWE-400: Uncontrolled Resource Consumption. By sending a stream that begins with 0xc1 followed by arbitrary amounts of data, an attacker can force the application to allocate memory continuously for buffering purposes. This constitutes a Denial of Service attack vector where remote peers can exhaust available system memory on the server or client side. The impact is particularly acute in high-throughput environments or services processing untrusted input streams from external sources, as even modest amounts of malicious data can lead to significant memory pressure and eventual application crash due to out-of-memory conditions.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates resource exhaustion attacks often associated with T1498: Network Denial of Service or more specifically local resource consumption leading to service disruption. The lack of input validation for reserved protocol bytes represents a failure in boundary enforcement and data type consistency checks during the parsing phase. This allows an adversary to manipulate the internal state machine of the decoder, keeping it in a waiting loop that consumes computational resources without producing any useful output or error signal to halt the process gracefully.
The recommended mitigation is straightforward: upgrade msgpack5 to version 6.1.0 or later where this logic has been corrected. In patched versions, the decoder properly identifies reserved bytes like 0xc1 as invalid input and throws an appropriate exception immediately upon detection, preventing any further buffering of subsequent data. For applications unable to update immediately due to dependency constraints, implementing a wrapper layer that validates incoming streams for known invalid prefixes before passing them to the msgpack5 parser can provide temporary protection. Additionally, enforcing strict limits on buffer sizes or stream lengths at the network protocol level can mitigate the impact by capping memory usage regardless of how the underlying library handles specific byte sequences.