{"id":"GHSA-gcx5-hxj7-gpqq","revision":"40cb8cdbca344adcbe90fe32bccea75a","records":[{"revision":"40cb8cdbca344adcbe90fe32bccea75a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gcx5-hxj7-gpqq","aliases":["CVE-2026-107297"],"title":"msgpack5: Quadratic parsing in the streaming decoder","description":"### Impact\n\nThe streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.\n\n### Patches\n\nThe decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.\n\n### Workarounds\n\nBuffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.","state":0,"publishedAt":"2026-10-08T17:39:46+00:00","modifiedAt":"2026-10-08T18:00:08.9044622+00:00","affected":[{"ecosystem":"npm","name":"msgpack5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq","https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4","https://github.com/mcollina/msgpack5","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"],"sourceUrl":"https://github.com/advisories/GHSA-gcx5-hxj7-gpqq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gcx5-hxj7-gpqq","identifiers":["GHSA-gcx5-hxj7-gpqq","CVE-2026-107297"]},"retained":false,"historicalAffected":[]}],"coverage":[]}