Patch Forecast
Amber warning
Patch this week.

CVE-2026-107300 · GHSA-5x5g-h9x8-2fh9

msgpack5: Many buffered values can exhaust the streaming decoder stack

Risk score
62/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhaust…
Affected
msgpack5 (npm) < 6.1.0
Fix
Upgrade msgpack5 to 6.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: msgpack5THE FLAWSTHE FIXCVE-2026-107300Many buffered values canexhaust the streaming decoderstackCVSS 7.5 · EPSS 0%CVE-2026-107302Truncated map32 headersthrow an unexpected errorCVSS 7.5 · EPSS 0%CVE-2026-107301Partial options disableprototype protectionCVSS 6.5 · EPSS 0%CVE-2026-107299Reserved byte can causeunbounded stream bufferingCVSS 5.9 · EPSS 0%Upgrade msgpack56.1.0or later on your release lineWho is exposedmsgpack5 (npm) < 6.1.0AMBER · PATCH THIS WEEKmsgpack5msgpack5 is a msgpack v5implementation for node.js andthe browser. Prior to 6.1.0, thestreaming decoder recursivelyinvokes itself for each completeMessagePack value remaining ina chunk. A remote peer can send…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-674 (CWE-674)56 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

msgpack5: Amber, patch this week. msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhaust…

The flaws

  • CVE-2026-107300: Many buffered values can exhaust the streaming decoder stack (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107302: Truncated map32 headers throw an unexpected error (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107301: Partial options disable prototype protection (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107299: Reserved byte can cause unbounded stream buffering (CVSS 5.9 · EPSS 0%)

The fix

Upgrade msgpack5: 6.1.0 or later on your release line

Who is exposed: msgpack5 (npm) < 6.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
msgpack5npm< 6.1.06.1.0

References

Original description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.