CVE-2023-52079 Conversion of property names to strings can trigger infinite recursion
Attackers can cause denial of service in msgpackr by sending crafted messages that trigger infinite recursion during decoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52079?
CVE-2023-52079 is a medium-severity denial of service vulnerability in kriszyp msgpackr, published on 28 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
Which versions are affected by CVE-2023-52079?
2 open source packages ship an affected version, including msgpackr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
msgpackr npm | All versions | 1.10.1 |
msgpackr npm | All versions | 1.10.1 |
Products include Kriszyp Msgpackr.
How do I fix CVE-2023-52079?
Upgrade msgpackr to 1.10.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-52079 being exploited?
There is no known exploitation of CVE-2023-52079 in the wild and no public exploit code.
Sources
Also known as GHSA-7hpj-7hhx-2fgx.