CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
A remote attacker can exhaust memory in msgpack5 by sending a reserved byte, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107299?
CVE-2026-107299 is a medium-severity denial of service vulnerability in mcollina msgpack5, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.
Weakness: CWE-228
Which versions are affected by CVE-2026-107299?
2 open source packages ship an affected version, including msgpack5.
| Package | Affected | Fixed in |
|---|---|---|
msgpack5 npm | All versions | 6.1.0 |
msgpack5 npm | All versions | 6.1.0 |
How do I fix CVE-2026-107299?
Upgrade msgpack5 to 6.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107299 being exploited?
There is no known exploitation of CVE-2026-107299 in the wild and no public exploit code.
Sources
Also known as AZL-106848, GHSA-26wq-p25c-j6fv.