CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
A remote attacker can cause a denial of service by sending a chunk with many small values, exhausting the call stack in the msgpack5 streaming decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107300?
CVE-2026-107300 is a high-severity denial of service vulnerability in mcollina msgpack5, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
Weakness: CWE-674
Which versions are affected by CVE-2026-107300?
2 open source packages ship an affected version, including msgpack5.
| Package | Affected | Fixed in |
|---|---|---|
msgpack5 npm | All versions | 6.1.0 |
msgpack5 npm | All versions | 6.1.0 |
How do I fix CVE-2026-107300?
Upgrade msgpack5 to 6.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107300 being exploited?
There is no known exploitation of CVE-2026-107300 in the wild and no public exploit code.
Sources
Also known as AZL-106851, GHSA-5x5g-h9x8-2fh9.