Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107297 · GHSA-gcx5-hxj7-gpqq

msgpack5: Quadratic parsing in the streaming decoder

Risk score
47/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded re…
Affected
msgpack5 (npm) < 6.1.0
Fix
Upgrade msgpack5 to 6.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: msgpack5THE FLAWSTHE FIXCVE-2026-107297Quadratic parsing in thestreaming decoderCVSS 5.9 · EPSS 0%CVE-2026-107302Truncated map32 headersthrow an unexpected errorCVSS 7.5 · EPSS 0%CVE-2026-107300Many buffered values canexhaust the streaming decoderstackCVSS 7.5 · EPSS 0%CVE-2026-107301Partial options disableprototype protectionCVSS 6.5 · EPSS 0%Upgrade msgpack56.1.0or later on your release lineWho is exposedmsgpack5 (npm) >= 4.1.0, < 6.1.0AMBER · PATCH THIS WEEKmsgpack5msgpack5 is a msgpack v5implementation for node.js andthe browser. Prior to 6.1.0, thedecoder reads the four-bytelength of a map32 value beforevalidating that the completefive-byte header is available. A…Where it standsNo known exploitationCONNECTS TOSame weaknessDenial of service (CWE-407)70 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

msgpack5: Amber, patch this week. msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of …

The flaws

  • CVE-2026-107297: Quadratic parsing in the streaming decoder (CVSS 5.9 · EPSS 0%)
  • CVE-2026-107302: Truncated map32 headers throw an unexpected error (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107300: Many buffered values can exhaust the streaming decoder stack (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107301: Partial options disable prototype protection (CVSS 6.5 · EPSS 0%)

The fix

Upgrade msgpack5: 6.1.0 or later on your release line

Who is exposed: msgpack5 (npm) >= 4.1.0, < 6.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
msgpack5npm< 6.1.06.1.0

References

Original description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.