40 matches found
GHSA-5X5G-H9X8-2FH9 msgpack5: Many buffered values can exhaust the streaming decoder stack
Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...
NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack
NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
msgpack5: Many buffered values can exhaust the streaming decoder stack
Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...
NPM: msgpack5: Quadratic parsing in the streaming decoder
NPM: msgpack5: Quadratic parsing in the streaming decoder vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
msgpack5: Quadratic parsing in the streaming decoder
Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...
GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder
Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...
AZL-106851 CVE-2026-107300 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
AZL-106848 CVE-2026-107299 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
AZL-106842 CVE-2026-107297 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
CVE-2026-107297
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
CVE-2026-107299
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
CVE-2026-107300
The msgpack5 library, a msgpack v5 implementation for node.js and the browser , is vulnerable to a stack exhaustion issue in versions prior to 6.1.0 . The streaming decoder recursively invokes itself for every complete MessagePack value found within a chunk. A remote peer can exploit this by send...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
EUVD-2026-95111
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...
CVE-2026-107299
The msgpack5 library, a MessagePack v5 implementation for Node.js and browsers, is vulnerable in versions prior to 6.1.0 . The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid input. When this byte begins a stream, subsequent data rem...
CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...
EUVD-2026-95110
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...