CVE-2026-107298 Details

A denial-of-service vulnerability has been identified in msgpack5, a MessagePack v5 implementation for Node.js and the browser. Prior to version 6.1.0, the library's array and map decoding processes lacked a nesting-depth limit. This flaw allowed attackers to submit deeply nested containers that could exhaust the JavaScript call stack, disrupting a process, worker, or request handler.

Users can update to msgpack5 version 6.1.0 or later, which includes a default maximum depth limit of 100 for decoding arrays and maps. Applications can also configure this limit with the 'maxDepth' option. For those using earlier versions, it is advisable to reject deeply nested input before decoding, isolate the decoding process in a worker, or enforce a trusted schema that limits nesting depth.