@58860ed6ffd9e897/gold-finger-extension (1.0.2), @airfleet/wordpress-dev (>=2.2.0, <=2.2.4) +256 more potentially affected by CVE-2023-52079 via msgpackr (>=1.2.9, <=1.10.0)

msgpackr NPM version =1.2.9, =2.2.0, =1.2.0, =0.3.0, =2.9.3, =2.3.0, =1.9.13, =0.84.3, =1.0.73, =1.0.73, =4.0.2-cmmn, =3.0.5, =1.0.55, =2.0.10 and more Source cves: CVE-2023-52079 Source advisory: OSV:GHSA-7HPJ-7HHX-2FGX...

CVE-2023-52079

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured...

CVE-2023-52079

CVE-2023-52079 concerns msgpackr (NodeJS/JavaScript) before version 1.10.1. When decoding user-supplied MessagePack messages, the decoder can get stuck in a loop, tying up threads. The issue is associated with how certain extensions (e.g., 0x70) may be processed; a mitigation path involves replac...