Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107299 · GHSA-26wq-p25c-j6fv

msgpack5: Reserved byte can cause unbounded stream buffering

Risk score
47/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value val…
Affected
msgpack5 (npm) < 6.1.0
Fix
Upgrade msgpack5 to 6.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: msgpack5THE FLAWSTHE FIXCVE-2026-107299Reserved byte can causeunbounded stream bufferingCVSS 5.9 · EPSS 0%CVE-2026-107302Truncated map32 headersthrow an unexpected errorCVSS 7.5 · EPSS 0%CVE-2026-107300Many buffered values canexhaust the streaming decoderstackCVSS 7.5 · EPSS 0%CVE-2026-107301Partial options disableprototype protectionCVSS 6.5 · EPSS 0%Upgrade msgpack56.1.0or later on your release lineWho is exposedmsgpack5 (npm) >= 4.1.0, < 6.1.0AMBER · PATCH THIS WEEKmsgpack5msgpack5 is a msgpack v5implementation for node.js andthe browser. Prior to 6.1.0, thedecoder reads the four-bytelength of a map32 value beforevalidating that the completefive-byte header is available. A…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-228 (CWE-228)1 other warning in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

msgpack5: Amber, patch this week. msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of …

The flaws

  • CVE-2026-107299: Reserved byte can cause unbounded stream buffering (CVSS 5.9 · EPSS 0%)
  • CVE-2026-107302: Truncated map32 headers throw an unexpected error (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107300: Many buffered values can exhaust the streaming decoder stack (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107301: Partial options disable prototype protection (CVSS 6.5 · EPSS 0%)

The fix

Upgrade msgpack5: 6.1.0 or later on your release line

Who is exposed: msgpack5 (npm) >= 4.1.0, < 6.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
msgpack5npm< 6.1.06.1.0

References

Original description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.