CVE-2026-107302: msgpack5 - Out-of-Bounds Read Due to Truncated map32 Header

Background

msgpack5 is a popular JavaScript library used for encoding and decoding MessagePack data format, which is a binary format that is efficient for data serialization. It is widely utilized in applications that require fast data exchange. However, it has a vulnerability that can lead to unexpected errors when handling truncated map32 headers, potentially affecting application stability.

Vulnerability Detail

The vulnerability arises from a truncated map32 header that causes an out-of-bounds buffer read. Instead of throwing an IncompleteBufferError, it throws a RangeError. This can lead to applications that depend on IncompleteBufferError to handle incomplete data to terminate requests, streams, or workers unexpectedly. Although no adjacent memory is disclosed due to buffer implementation checks, the impact on application flow can be significant.

npm install msgpack5@6.1.0

Workaround

As a temporary workaround, ensure that at least five bytes are required before decoding a value that begins with 0xdf. Alternatively, you can catch the RangeError and treat it as incomplete input specifically for truncated map32 headers. Here is an example of how to implement this in your code:

try {

    // Your decoding logic here
} catch (error) {
    if (error instanceof RangeError) {
        // Handle as incomplete input
    }
}

Conclusion

In summary, the msgpack5 library has a vulnerability related to truncated map32 headers that can lead to unexpected application behavior. It is crucial to update to version 6.1.0 or later to mitigate this risk. Additionally, implementing workarounds can help manage the issue until an update is applied.

See every vulnerability recorded for msgpack5 →

FAQ