Improper Handling of Syntactically Invalid Structure

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the...

Improper Handling of Syntactically Invalid Structure

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the reserved...

GHSA-26WQ-P25C-J6FV msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

CVE-2026-107299

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

CVE-2026-107299

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

EUVD-2026-95110

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

PT-2026-108616

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

June 5, 2018—KB4338548 (OS Build 17134.83)

June 5, 2018—KB4338548 OS Build 17134.83 Applies To Windows 10, version 1803, all editions Summary This update addresses an issue where the 2017 and 2018 versions of Intuit QuickBooks Desktop can't run in multi-user mode on Windows 10, version 1803 devices. The QuickBooks multi-user mode service...