High severity · published Oct 8, 2026
CVE-2026-107300
msgpack5: Many buffered values can exhaust the streaming decoder stack
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
msgpack5 · mcollina
< 6.1.0 · source: vendor
Affected product
MS
msgpack5
mcollina
More from msgpack5
7.5
CVE-2026-107302
msgpack5: Truncated map32 headers throw an unexpected error
6.5
CVE-2026-107301
msgpack5: Partial options disable prototype protection
5.9
CVE-2026-107299
msgpack5: Reserved byte can cause unbounded stream buffering
5.9
CVE-2026-107297
msgpack5: Quadratic parsing in the streaming decoder
5.3
CVE-2026-107298
msgpack5: Deeply nested input can exhaust the decoder stack