{"id":"EUVD-2026-95110","enisaUuid":"5427191d-6c65-34bc-9989-2978ce18dfdd","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:09:47 PM","dateUpdated":"Oct 9, 2026, 3:15:00 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv\nhttps://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","aliases":"CVE-2026-107299\nGHSA-26wq-p25c-j6fv\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"c6d57496-b71c-3492-939a-e95585f08a79","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"enisaIdVendor":[{"id":"f8101ba0-cb2a-35a4-a8dd-f07d503137b9","vendor":{"name":"mcollina"}}],"enisaIdVulnerability":[{"id":"96404486-f7c1-3884-8843-f842f531984f","vulnerability":{"id":"CVE-2026-107299","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:09:47 PM","dateUpdated":"Oct 9, 2026, 3:15:00 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv\nhttps://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95110\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 8, 2026, 7:16:38 AM","vulnerabilityProduct":[{"id":"d7bbd794-5f1f-33f8-b554-f4ccc2ac3cde","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"vulnerabilityVendor":[{"id":"69ba7029-b071-3d18-9911-58aca6067042","vendor":{"name":"mcollina"}}]}},{"id":"ce68308b-cafa-3856-9395-0706f287ef8c","vulnerability":{"id":"GHSA-26wq-p25c-j6fv","description":"msgpack5: Reserved byte can cause unbounded stream buffering","datePublished":"Oct 8, 2026, 5:40:01 PM","dateUpdated":"Oct 8, 2026, 5:40:01 PM","baseScore":0.0,"references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv\nhttps://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314\nhttps://github.com/mcollina/msgpack5\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95110\n","aliases":"CVE-2026-107299\nGHSA-26wq-p25c-j6fv\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"a50fd619-b5e6-31bc-9f9a-a2ba37976798","advisory":{"id":"msrc_CVE-2026-107299","description":"msgpack5: Reserved byte can cause unbounded stream buffering","datePublished":"Oct 10, 2026, 1:03:45 AM","dateUpdated":"Oct 16, 2026, 1:45:39 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-107299.json\n","aliases":"CVE-2026-107299\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"6d767d56-1558-38b6-944a-26c817c80756","product":{"name":"azl3 msgpack 0:3.3.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"9ebfeac9-2fda-393f-a479-e06e26c52198","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"fa0b14aa-5f35-3cdf-ad35-facb1022bd66","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}