CVE-2026-107297: msgpack5 Quadratic Parsing Vulnerability in Streaming Decoder
Summary
CVE-2026-107297: msgpack5: Quadratic parsing in the streaming decoder. Affects msgpack5 versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
msgpack5 is a popular library in the npm ecosystem that facilitates the serialization and deserialization of data using the MessagePack format. It is designed for high performance and efficiency, making it a preferred choice for developers needing to transmit data between systems. However, the library is susceptible to a vulnerability in its streaming decoder, which can lead to significant performance degradation under certain conditions.
Vulnerability Detail
The vulnerability arises from the streaming decoder's method of handling incomplete containers. When a new chunk of data arrives, the decoder reprocesses the entire container from the beginning, which can lead to quadratic CPU usage. This behavior allows a remote peer to exploit the vulnerability by splitting a valid MessagePack value into multiple small chunks, causing the event loop to block and potentially leading to denial of service.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can buffer each complete MessagePack value before decoding it. Additionally, consider limiting the number of chunks accepted for a single value to mitigate the impact of this vulnerability.
Conclusion
The msgpack5 library has a vulnerability in its streaming decoder that can lead to significant CPU usage and potential denial of service. It is crucial for developers using this library to update to version 6.1.0 or later to mitigate this risk. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for msgpack5 →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to excessive CPU usage and blocking of the event loop, which may result in denial of service for applications relying on the msgpack5 library.
Yes, a patch is available in version 6.1.0 of the msgpack5 package. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, consider implementing the suggested workarounds, such as buffering complete MessagePack values before decoding.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
