GHSA-24ch-f2g6-9hhh

Source

https://github.com/advisories/GHSA-24ch-f2g6-9hhh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-24ch-f2g6-9hhh/GHSA-24ch-f2g6-9hhh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-24ch-f2g6-9hhh

Aliases

CVE-2026-107298

Published

2026-10-08T17:39:51Z

Modified

2026-10-08T18:00:09Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

msgpack5: Deeply nested input can exhaust the decoder stack

Details

Impact

The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.

Patches

The decoder now limits nesting depth to 100 by default and throws Maximum decode depth exceeded. Applications can configure the limit with the maxDepth option.

Workarounds

Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.

Database specific

{
    "cwe_ids": [
        "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:39:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / msgpack5

Package

Name: msgpack5; View open source insights on deps.dev
Purl: pkg:npm/msgpack5

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-24ch-f2g6-9hhh/GHSA-24ch-f2g6-9hhh.json"