CLSA-2026-1791806348 TuxCare security update for msgpack5 (5 CVEs)

TuxCare rebuilt msgpack5 to address 5 CVEs. Fixed in 4.5.1-tuxcare.1...

PT-2026-121443

TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 4.5.1-tuxcare.1...

AZL-106845 CVE-2026-107302 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...

CVE-2026-107302

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...

NPM: msgpack5: Truncated map32 headers throw an unexpected error

NPM: msgpack5: Truncated map32 headers throw an unexpected error vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...

GHSA-8F34-F56X-9XPH msgpack5: Truncated map32 headers throw an unexpected error

Impact A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because...

6du (>=0.0.1, <=0.0.5), @aaqilniz/loopback-connector (5.1.0) +753 more potentially affected by CVE-2026-107302 via msgpack5 (>=4.2.0, <=6.0.2)

msgpack5 NPM version =4.2.0, =0.0.1, =6.1.0, =4.27.2, =0.0.1, =0.0.1, =2.0.0-rc5, =0.0.99, =0.16.9, =1.0.18, =1.0.0, =1.0.1 and more Source cves: CVE-2026-107302 Source advisory: OSV:GHSA-8F34-F56X-9XPH...

6du (>=0.0.1, <=0.0.5), @aaqilniz/loopback-connector (5.1.0) +753 more potentially affected by CVE-2026-107302 via msgpack5 (>=4.2.0, <=6.0.2)

msgpack5 NPM version =4.2.0, =0.0.1, =6.1.0, =4.27.2, =0.0.1, =0.0.1, =2.0.0-rc5, =0.0.99, =0.16.9, =1.0.18, =1.0.0, =1.0.1 and more Source cves: CVE-2026-107302 Source advisory: GHSA-8F34-F56X-9XPH...

@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107302 via msgpack5 (>=6.0.1, <=6.0.2)

msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107302 Source advisory: SNYK:JS-MSGPACK5-20581254...

msgpack5: Truncated map32 headers throw an unexpected error

Impact A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because...

Out-of-bounds Read

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Out-of-bounds Read via incomplete map32 header detection in lib/decoder.js. The SIZES lookup table was missing an entry for the 0xdf map32...

NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack

NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...

msgpack5: Many buffered values can exhaust the streaming decoder stack

Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...

GHSA-5X5G-H9X8-2FH9 msgpack5: Many buffered values can exhaust the streaming decoder stack

Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...

@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107300 via msgpack5 (>=6.0.1, <=6.0.2)

msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107300 Source advisory: GHSA-5X5G-H9X8-2FH9...

@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107300 via msgpack5 (>=6.0.1, <=6.0.2)

msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107300 Source advisory: OSV:GHSA-5X5G-H9X8-2FH9...

@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107300 via msgpack5 (>=6.0.1, <=6.0.2)

msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107300 Source advisory: SNYK:JS-MSGPACK5-20581692...

Uncontrolled Recursion

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the transform method in lib/streams.js, where the decoder recursively calls itself when the chunk buffer still...

NPM: msgpack5: Reserved byte can cause unbounded stream buffering

NPM: msgpack5: Reserved byte can cause unbounded stream buffering vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...

msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...