157 matches found
EUVD-2026-95112
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...
CVE-2026-107301 msgpack5: Partial options disable prototype protection
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...
CVE-2026-107300
The msgpack5 library, a msgpack v5 implementation for node.js and the browser , is vulnerable to a stack exhaustion issue in versions prior to 6.1.0 . The streaming decoder recursively invokes itself for every complete MessagePack value found within a chunk. A remote peer can exploit this by send...
EUVD-2026-95111
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107300 via msgpack5 (>=6.0.1, <=6.0.2)
msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107300 Source advisory: MEND:CVE-2026-107300...
CVE-2026-107300
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107299
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
EUVD-2026-95110
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
CVE-2026-107299
The msgpack5 library, a MessagePack v5 implementation for Node.js and browsers, is vulnerable in versions prior to 6.1.0 . The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid input. When this byte begins a stream, subsequent data rem...
@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107299 via msgpack5 (>=6.0.1, <=6.0.2)
msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107299 Source advisory: MEND:CVE-2026-107299...
CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
@forwardemail/wildduck (>=1.40.10, <=4.0.3), @johnqh/haraka (>=8.0.1, <=8.0.17) +13 more potentially affected by CVE-2026-107298 via msgpack5 (>=6.0.1, <=6.0.2)
msgpack5 NPM version =6.0.1, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =1.0.0, =1.0.0-alpha.1, =5.8.30, =0.0.1, =1.46.1, =1.32.21, =2.60.1, =1.1.0, =1.38.0, =1.1.0, =1.32.21 Source cves: CVE-2026-107298 Source advisory: MEND:CVE-2026-107298...
CVE-2026-107298 msgpack5: Deeply nested input can exhaust the decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a...
CVE-2026-107298
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a...
EUVD-2026-95109
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a...