CVE-2026-107300
Received Received - Intake

msgpack5 JavaScript Call Stack Exhaustion via Recursive Decoding

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107300
EUVD
EUVD-2026-95111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mcollina msgpack5 < 6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack overflow issue in the msgpack5 library before version 6.1.0. The streaming decoder processes MessagePack values recursively, so a single chunk containing many small values causes excessive recursion, exhausting the JavaScript call stack and crashing the process.

Detection Guidance

To detect this vulnerability, check if your system uses msgpack5 versions prior to 6.1.0. Run 'npm list msgpack5' or inspect package.json for version details. Monitor for stack overflow errors during message processing, especially with large batches of small MessagePack values.

Impact Analysis

An attacker could send a malicious chunk with many small MessagePack values, causing your application to crash or become unresponsive. This disrupts service availability and may lead to denial-of-service conditions for systems using vulnerable versions of msgpack5.

Compliance Impact

This vulnerability primarily impacts system availability due to potential process interruption from stack exhaustion. It does not directly expose or leak data, so confidentiality or integrity breaches are unlikely. However, availability issues could violate service-level agreements or operational requirements in GDPR or HIPAA compliance frameworks that mandate system uptime and reliability.

Mitigation Strategies

Upgrade msgpack5 to version 6.1.0 or later to address the stack overflow issue in the streaming decoder.

  • If upgrading is not immediately possible, limit the number of values per chunk or split large batches before decoding to reduce recursion depth.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart