GHSA-26wq-p25c-j6fv

Source

https://github.com/advisories/GHSA-26wq-p25c-j6fv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-26wq-p25c-j6fv/GHSA-26wq-p25c-j6fv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-26wq-p25c-j6fv

Aliases

CVE-2026-107299

Published

2026-10-08T17:40:01Z

Modified

2026-10-08T18:00:08Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

msgpack5: Reserved byte can cause unbounded stream buffering

Details

Impact

The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.

Patches

The decoder now rejects 0xc1 as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.

Workarounds

Reject 0xc1 before streaming input to msgpack5, and enforce stream byte and time limits.

Database specific

{
    "cwe_ids": [
        "CWE-228"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:40:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / msgpack5

Package

Name: msgpack5; View open source insights on deps.dev
Purl: pkg:npm/msgpack5

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-26wq-p25c-j6fv/GHSA-26wq-p25c-j6fv.json"