{"id":"GHSA-5x5g-h9x8-2fh9","revision":"16535667fd854303b224d8fc7ff03d5f","records":[{"revision":"16535667fd854303b224d8fc7ff03d5f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-5x5g-h9x8-2fh9","aliases":["CVE-2026-107300"],"title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"### Impact\n\nThe streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.\n\n### Patches\n\nThe streaming decoder now drains concatenated values iteratively with constant call-stack depth.\n\n### Workarounds\n\nLimit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.","state":0,"publishedAt":"2026-10-08T17:40:06+00:00","modifiedAt":"2026-10-08T18:00:08.8930767+00:00","affected":[{"ecosystem":"npm","name":"msgpack5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9","https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba","https://github.com/mcollina/msgpack5","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"],"sourceUrl":"https://github.com/advisories/GHSA-5x5g-h9x8-2fh9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5x5g-h9x8-2fh9","identifiers":["GHSA-5x5g-h9x8-2fh9","CVE-2026-107300"]},"retained":false,"historicalAffected":[]}],"coverage":[]}