Buffer Read Error in msgpack5 Library

Executive Summary

This vulnerability affects msgpack5, a MessagePack v5 implementation for Node.js and browsers. Prior to version 6.1.0, the decoder reads a four-byte length for map32 values without first validating the full five-byte header. A truncated map32 header causes an out-of-bounds buffer read, throwing a RangeError instead of the expected IncompleteBufferError. This can unexpectedly terminate requests, streams, or workers in applications waiting for additional bytes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of msgpack5 in use. Run npm list msgpack5 or check package.json for versions prior to 6.1.0. If using a vulnerable version, update immediately. No specific network commands are needed as this is a library-level issue.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause unexpected crashes in applications using msgpack5 versions before 6.1.0. If a truncated map32 header is received, the application may terminate unexpectedly instead of handling the incomplete data gracefully. This could disrupt services, especially in streaming or networked environments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade msgpack5 to version 6.1.0 or later. As a temporary workaround, ensure at least five bytes are available before decoding values starting with 0xdf or catch RangeError and treat it as incomplete input for truncated map32 headers.

Useful 0 Not Useful 0