GHSA-26WQ-P25C-J6FV msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

Improper Handling of Syntactically Invalid Structure

Overview org.webjars.npm:msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure via the tryDecode function in lib/decoder.js, which does not reject the...

CVE-2026-107299

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...