{"id":"EUVD-2026-95114","enisaUuid":"2478b5e9-604d-31c0-ac74-22107660dae1","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:14:19 PM","dateUpdated":"Oct 19, 2026, 7:29:15 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph\nhttps://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","aliases":"CVE-2026-107302\nGHSA-8f34-f56x-9xph\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"fc3c27d1-3d37-36b6-bbfd-a49542c95f30","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"4.1.0. \u003c 6.1.0"}],"enisaIdVendor":[{"id":"d6eb895b-980d-3c0f-a5d8-39fe51381645","vendor":{"name":"mcollina"}}],"enisaIdVulnerability":[{"id":"3fdc35fe-dcab-38b0-804d-266a7df8b7d2","vulnerability":{"id":"GHSA-8f34-f56x-9xph","description":"msgpack5: Truncated map32 headers throw an unexpected error","datePublished":"Oct 8, 2026, 5:40:10 PM","dateUpdated":"Oct 19, 2026, 7:28:58 PM","baseScore":0.0,"references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107302\nhttps://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1\nhttps://github.com/mcollina/msgpack5\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95114\n","aliases":"CVE-2026-107302\nGHSA-8f34-f56x-9xph\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8ba3bcb0-60e0-3648-9638-e55b0910cf39","vulnerability":{"id":"CVE-2026-107302","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:14:19 PM","dateUpdated":"Oct 19, 2026, 7:29:15 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph\nhttps://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95114\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Oct 27, 2026, 7:17:00 AM","vulnerabilityProduct":[{"id":"f40fa1bf-7456-33fc-a792-f1c3b536a3aa","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"4.1.0. \u003c 6.1.0"}],"vulnerabilityVendor":[{"id":"aee68e4a-de4f-3839-a7cb-326127a74c7b","vendor":{"name":"mcollina"}}]}}],"enisaIdAdvisory":[{"id":"981aa9c4-d241-3e82-be81-f982bf73540c","advisory":{"id":"msrc_CVE-2026-107302","description":"msgpack5: Truncated map32 headers throw an unexpected error","datePublished":"Oct 10, 2026, 1:03:20 AM","dateUpdated":"Oct 16, 2026, 1:45:37 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-107302.json\n","aliases":"CVE-2026-107302\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"3599dc7d-4470-347e-947e-9a537385a223","product":{"name":"azl3 msgpack 0:3.3.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"427f1152-38fe-3b93-9d9f-df0f01845c19","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"99bc7ef9-698a-3c03-a78a-09a9c355d350","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}