CVE-2026-107297 Details

A denial-of-service vulnerability has been identified in msgpack5, a MessagePack v5 implementation for Node.js and the browser, affecting versions prior to 6.1.0. The issue arises in the streaming decoder, which improperly handles incomplete arrays or maps by reprocessing them from the start each time a new chunk is received. This flaw allows a remote peer to fragment a valid MessagePack container across multiple small chunks, leading to excessive CPU consumption and event loop blockage. The vulnerability is rooted in the decoder's failure to maintain the state of partially processed containers, causing completed elements to be decoded multiple times.

Users can upgrade to msgpack5 version 6.1.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the GitHub releases page.