MessagePack v5 Implementation Vulnerability in msgpack5 by mcollina

CVE-2026-107299

What is CVE-2026-107299?

The msgpack5 library, utilized in both Node.js and browser environments, contains a vulnerability that allows a remote attacker to cause a denial of service through a malformed MessagePack byte (0xc1). This byte is incorrectly interpreted, leading the streaming decoder to await additional bytes to validate the value, instead of recognizing it as invalid input. As the decoder remains in a waiting state, it buffers the subsequent data, which can lead to memory exhaustion. This issue has been addressed in version 6.1.0 of msgpack5.

References