Stack Overflow Vulnerability in msgpack5 by mcollina

CVE-2026-107298

What is CVE-2026-107298?

The msgpack5 library for Node.js and the browser was found to have a potential stack exhaustion vulnerability prior to version 6.1.0. This issue arises from the lack of a nesting-depth limit in the decoding paths for arrays and maps. An attacker could exploit this vulnerability by supplying MessagePack input containing deeply nested containers, which could recursively exhaust the JavaScript call stack. This could disrupt processes, workers, or request handlers, leading to application instability. The issue has been remedied in version 6.1.0, emphasizing the necessity for users to update to the latest version for enhanced security.

References