Summary
msgpack5: Many buffered values can exhaust the streaming decoder stack
Advisory details
Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
- HIGHCVE-2026-58280
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-91968
Vikunja: Unbounded nested task-filter recursion permits API process termination
- MEDIUMCVE-2026-107833
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
- HIGHCVE-2026-107826
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
- MEDIUMCVE-2026-107298
msgpack5: Deeply nested input can exhaust the decoder stack