CVE-2026-107302 in msgpack5
Summary
by MITRE • 10/08/2026
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The msgpack5 library serves as an implementation of the MessagePack v5 serialization format, widely utilized in Node.js and browser environments for efficient binary data exchange. A critical flaw was identified within the decoder logic prior to version 6.1.0 regarding the handling of map32 type headers. The vulnerability stems from a specific ordering error in the validation sequence where the decoder attempts to read the four-byte length field associated with a map32 value before confirming that the complete five-byte header structure is present in the input buffer. This logical inversion means that when processing truncated or malformed data, the library proceeds to access memory locations intended for the payload length without first verifying if those bytes actually exist within the allocated buffer space.
This implementation flaw results in a checked out-of-bounds buffer read operation. While the underlying Node.js Buffer implementation includes bounds checking mechanisms that prevent arbitrary code execution or adjacent-memory disclosure by throwing an exception rather than returning corrupted data, the nature of this exception is problematic for application stability. Specifically, the decoder throws a generic RangeError instead of the expected IncompleteBufferError. This discrepancy disrupts standard error handling patterns in applications designed to handle partial reads gracefully. Many streaming parsers and network clients rely on catching IncompleteBufferError to signal that more data needs to be read from the source before processing can continue.
The operational impact of this vulnerability is primarily related to service availability rather than confidentiality or integrity. When a truncated map32 header is encountered, the unexpected RangeError propagates up the call stack and typically terminates the current request, stream, or worker process abruptly. This behavior violates the principle of graceful degradation in streaming protocols where partial data should trigger a wait state for additional input rather than an immediate crash. Consequently, attackers who can influence the structure of incoming MessagePack payloads may induce denial-of-service conditions by sending specially crafted truncated headers that force the application to terminate unexpectedly, thereby disrupting service continuity and potentially causing resource exhaustion if restarts are not managed efficiently.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation as the core failure lies in the incorrect validation of input data structure completeness before processing. It also relates to CWE-754 Improper Check for Unusual or Exceptional Conditions because the code fails to handle an exceptional state (incomplete header) appropriately according to its intended design contract. In terms of adversary tactics, this vulnerability supports Denial of Service scenarios within the MITRE ATT&CK framework by allowing remote actors to disrupt service availability through malformed input that triggers unhandled exceptions in parsing routines.
To mitigate this risk, organizations utilizing msgpack5 must upgrade immediately to version 6.1.0 or later where the validation order has been corrected to ensure header completeness is verified before attempting to read associated length fields. For applications unable to update instantly, implementing robust error handling that catches both RangeError and IncompleteBufferError may provide temporary resilience against crashes caused by truncated inputs. However, upgrading remains the definitive solution as it addresses the root cause within the parsing logic itself ensuring compliance with expected streaming behavior standards.