CVE-2026-107300

Summary

The msgpack5 library has a recursive streaming decoder that can be exhausted by sending many small valid MessagePack values in a single chunk, leading to JavaScript call stack overflow and process interruption. This affects applications using the library for message processing.

Exploitability

Exploitation is relatively straightforward as it requires only sending a specially crafted chunk with many small values to trigger the recursive calls, with no authentication or complex preconditions needed.

Blast radius

The impact could be significant across applications that use msgpack5 for streaming message processing, potentially causing widespread service disruption and denial of service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.1.0 or later to fix the recursive call stack exhaustion issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.