CVE-2026-107300: msgpack5 Package Stack Exhaustion Vulnerability
Summary
CVE-2026-107300: msgpack5: Many buffered values can exhaust the streaming decoder stack. Affects msgpack5 versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
msgpack5 is a popular JavaScript library used for encoding and decoding MessagePack data, a binary format that is efficient for data interchange. The library is widely utilized in applications that require fast serialization and deserialization of data. However, it is susceptible to a vulnerability that can lead to stack exhaustion when processing a large number of small MessagePack values in a single chunk.
Vulnerability Detail
The vulnerability arises from the streaming decoder's recursive invocation for each complete value remaining in a chunk. When a single chunk contains many small valid MessagePack values, it can exhaust the JavaScript call stack, potentially interrupting the process or stream. This can lead to application crashes or degraded performance, making it a significant concern for developers relying on msgpack5 for data processing.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, limit the number of MessagePack values accepted in one chunk or split large batches before passing them to the decoder stream. For example, if you are processing an array of MessagePack values, you can split it into smaller arrays before decoding:
Conclusion
The msgpack5 package has a significant vulnerability (CVE-2026-107300) that can lead to stack exhaustion when processing many small MessagePack values. It is crucial to update to version 6.1.0 or later to mitigate this risk. Additionally, implementing workarounds can help manage the issue until an update is applied.
See every vulnerability recorded for msgpack5 →
FAQ
CVE-2026-107300 is a vulnerability in the msgpack5 package that can lead to stack exhaustion when processing many small MessagePack values in a single chunk.
This vulnerability can cause your application to crash or degrade performance due to stack exhaustion, especially when handling large amounts of data.
All versions of msgpack5 prior to 6.1.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
