AZL-106848
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106848.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-106848
- Upstream
- Published
- 2026-10-08T17:17:15Z
- Modified
- 2026-10-09T14:17:20Z
- Summary
- CVE-2026-107299 affecting package msgpack 3.3.0-1
- Details
-
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.
- References