CVE-2026-107300 in msgpack5
Summary
by MITRE • 10/08/2026
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The msgpack5 library serves as a robust implementation of the MessagePack v5 serialization format for both Node.js environments and web browsers, facilitating efficient binary data exchange between applications. A critical vulnerability was identified within the streaming decoder component prior to version 6.1.0, where the internal logic responsible for parsing incoming data chunks contained a structural flaw in its recursive handling mechanism. Specifically, when processing a single chunk that contains multiple complete MessagePack values, the decoder invokes itself recursively for each value found rather than iterating through them using an iterative approach or managing state without deep call stack usage. This design choice creates a direct correlation between the number of serialized objects within one network packet and the depth of the JavaScript execution stack.
This architectural weakness allows a remote attacker to exploit the vulnerability by sending a single, carefully crafted chunk containing a large quantity of small, valid MessagePack values. As the decoder processes this input, it triggers a recursive call for every individual value contained in that chunk. Since JavaScript engines have finite limits on the size of the execution stack, an excessively deep recursion quickly leads to a stack overflow condition. This results in a Denial of Service scenario where the Node.js process crashes or the browser tab becomes unresponsive due to excessive memory consumption and CPU overhead associated with managing the call frames. The impact is particularly severe because it can be triggered remotely over network connections without requiring authentication, affecting any service that deserializes user-controlled MessagePack data using this library version.
From a classification perspective, this vulnerability aligns with CWE-675, which denotes operations on multiple input values in an uncontrolled recursive manner, leading to resource exhaustion. In the context of attack patterns, it corresponds to ATT&CK technique T1498, specifically Network Denial of Service via volumetric attacks or protocol abuse, as the attacker leverages a specific parsing behavior to disrupt service availability rather than consuming bandwidth alone. The root cause lies in the lack of iteration control within the streaming parser, highlighting the importance of avoiding recursion when processing unbounded input sequences in single-threaded environments like JavaScript runtimes.
To mitigate this risk, organizations utilizing msgpack5 must upgrade immediately to version 6.1.0 or later, where the developers have refactored the decoding logic to handle multiple values iteratively rather than recursively. For systems that cannot be updated instantly due to dependency constraints, implementing input validation at the network perimeter is advisable. This includes limiting the maximum size of incoming chunks and enforcing strict limits on the number of objects allowed within a single message payload. Additionally, deploying runtime monitoring tools that detect abnormal stack depth or frequent process crashes can help identify exploitation attempts in real-time while patching efforts are underway. Ensuring that all third-party dependencies are kept up to date is essential for maintaining the integrity and availability of services relying on binary serialization protocols.