{"id":"GHSA-26wq-p25c-j6fv","revision":"6320ab4421504c508238033628d7f6db","records":[{"revision":"6320ab4421504c508238033628d7f6db","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-26wq-p25c-j6fv","aliases":["CVE-2026-107299"],"title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"### Impact\n\nThe reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.\n\n### Patches\n\nThe decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.\n\n### Workarounds\n\nReject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.","state":0,"publishedAt":"2026-10-08T17:40:01+00:00","modifiedAt":"2026-10-08T18:00:08.9010314+00:00","affected":[{"ecosystem":"npm","name":"msgpack5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv","https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314","https://github.com/mcollina/msgpack5","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"],"sourceUrl":"https://github.com/advisories/GHSA-26wq-p25c-j6fv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-26wq-p25c-j6fv","identifiers":["GHSA-26wq-p25c-j6fv","CVE-2026-107299"]},"retained":false,"historicalAffected":[]}],"coverage":[]}