Patch Forecast
Amber warning
Patch this week.

CVE-2026-107302 · GHSA-8f34-f56x-9xph

msgpack5: Truncated map32 headers throw an unexpected error

Risk score
62/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of …
Affected
msgpack5 (npm) >= 4.1.0, < 6.1.0
Fix
Upgrade msgpack5 to 6.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: msgpack5THE FLAWSTHE FIXCVE-2026-107302Truncated map32 headersthrow an unexpected errorCVSS 7.5 · EPSS 0%CVE-2026-107300Many buffered values canexhaust the streaming decoderstackCVSS 7.5 · EPSS 0%CVE-2026-107301Partial options disableprototype protectionCVSS 6.5 · EPSS 0%CVE-2026-107299Reserved byte can causeunbounded stream bufferingCVSS 5.9 · EPSS 0%Upgrade msgpack56.1.0or later on your release lineWho is exposedmsgpack5 (npm) >= 4.1.0, < 6.1.0AMBER · PATCH THIS WEEKmsgpack5msgpack5 is a msgpack v5implementation for node.js andthe browser. Prior to 6.1.0, thedecoder reads the four-bytelength of a map32 value beforevalidating that the completefive-byte header is available. A…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)348 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

msgpack5: Amber, patch this week. msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of …

The flaws

  • CVE-2026-107302: Truncated map32 headers throw an unexpected error (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107300: Many buffered values can exhaust the streaming decoder stack (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107301: Partial options disable prototype protection (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107299: Reserved byte can cause unbounded stream buffering (CVSS 5.9 · EPSS 0%)

The fix

Upgrade msgpack5: 6.1.0 or later on your release line

Who is exposed: msgpack5 (npm) >= 4.1.0, < 6.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
msgpack5npm>= 4.1.0, < 6.1.06.1.0

References

Original description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.