AZL-106860

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106860.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-106860

Upstream

CVE-2026-107298

Published

2026-10-08T17:17:15Z

Modified

2026-10-09T14:17:21Z

Summary

CVE-2026-107298 affecting package msgpack 3.3.0-1

Details

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-107298

Affected packages

Azure Linux:3 / msgpack

Package

Name: msgpack
Purl: pkg:rpm/azure-linux/msgpack

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.3.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106860.json"