CVE-2026-107300CWE-674

CVE-2026-107300

High · published October 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00426 · 35.8th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-10-08T21:17Z
References (3)
https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba · [email protected]https://github.com/mcollina/msgpack5/releases/tag/v6.1.0 · [email protected]https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9 · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 17:11Z
    msgpack5: Many buffered values can exhaust the streaming decoder stack
    cvelistv5
  • 08 OCT 17:11Z
    msgpack5: Many buffered values can exhaust the streaming decoder stack
    cvelistv5