CVE-2026-42328 Details

A stack overflow vulnerability has been identified in go-ipld-prime versions prior to 0.23.0. The issue arises in the DAG-CBOR and DAG-JSON decoders, which process nested maps and lists without a depth limit. This flaw allows a payload with deeply nested collections to cause the decoder to recurse for each level of nesting, increasing the goroutine stack until the Go runtime terminates the process due to a fatal stack overflow. In DAG-CBOR, a payload of approximately 2 MB can create around 2 million recursion frames, exhausting the default 1 GB goroutine stack. DAG-JSON is similarly vulnerable to equivalent payloads. The vulnerability is rooted in schema-free decoding, which permits arbitrary nesting depth, and in schema-bound decoding, which only limits nesting when the schema is non-recursive and lacks 'Any'-typed fields.

The vulnerability is fixed in go-ipld-prime version 0.23.0, which introduces a configurable 'MaxDepth' option for both decoders, defaulting to 1024 nested levels. Users should upgrade to this version.