{"id":"EUVD-2026-95109","enisaUuid":"b755c5f7-2922-3fb7-8abf-2f495a1f3c7b","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:08:22 PM","dateUpdated":"Oct 9, 2026, 11:39:42 AM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh\nhttps://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","aliases":"CVE-2026-107298\nGHSA-24ch-f2g6-9hhh\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"cc6a1ae3-8a40-3411-83a0-a38c08ad09f1","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"enisaIdVendor":[{"id":"ad162014-a803-3d74-a1a7-66f2e7ba7f2d","vendor":{"name":"mcollina"}}],"enisaIdVulnerability":[{"id":"526760a1-5609-389b-9425-eeb5597a5302","vulnerability":{"id":"CVE-2026-107298","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:08:22 PM","dateUpdated":"Oct 9, 2026, 11:39:42 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh\nhttps://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95109\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Oct 29, 2026, 7:16:26 AM","vulnerabilityProduct":[{"id":"70e8c961-744d-307d-b8d8-0d7a4364a6b9","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"vulnerabilityVendor":[{"id":"a953d014-83d0-3a2a-9d7a-c722ea16f88a","vendor":{"name":"mcollina"}}]}},{"id":"ae889d98-c52f-30f6-934d-db32a41d76ce","vulnerability":{"id":"GHSA-24ch-f2g6-9hhh","description":"msgpack5: Deeply nested input can exhaust the decoder stack","datePublished":"Oct 8, 2026, 5:39:51 PM","dateUpdated":"Oct 8, 2026, 5:39:52 PM","baseScore":0.0,"references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh\nhttps://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102\nhttps://github.com/mcollina/msgpack5\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95109\n","aliases":"CVE-2026-107298\nGHSA-24ch-f2g6-9hhh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0aff6c0b-ff50-3b11-b848-0ca8e0448cae","advisory":{"id":"msrc_CVE-2026-107298","description":"msgpack5: Deeply nested input can exhaust the decoder stack","datePublished":"Oct 10, 2026, 1:05:18 AM","dateUpdated":"Oct 16, 2026, 1:45:47 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-107298.json\n","aliases":"CVE-2026-107298\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"9b8b6998-634d-3217-9208-568558ede771","product":{"name":"azl3 msgpack 0:3.3.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"ce87e18f-fe22-3ac5-b220-7682397129ee","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"e1aa65f6-fcf4-3de8-96ee-1e939cc9322c","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}}]}}]}