CVE-2026-107299: msgpack5 Unbounded Stream Buffering Due to Reserved Byte Handling
Summary
CVE-2026-107299: msgpack5: Reserved byte can cause unbounded stream buffering. Affects msgpack5 versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
msgpack5 is a popular JavaScript library used for encoding and decoding MessagePack data, a binary format that is efficient for data interchange. The library is widely utilized in applications that require fast serialization and deserialization of data. However, it has a vulnerability that arises from improper handling of a reserved byte, which can lead to significant memory issues.
Vulnerability Detail
The vulnerability stems from the incorrect treatment of the reserved MessagePack byte '0xc1'. When this byte appears at the start of a decoder stream, the decoder mistakenly considers the input incomplete. This causes the decoder to retain all subsequent data while waiting for additional bytes that will never arrive, leading to unbounded memory consumption and potential memory exhaustion. This issue can affect applications using msgpack5, especially those that process large streams of data.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a check to reject the byte '0xc1' before passing any input to msgpack5. This can be done with the following code snippet:
const input = ...; // your input data
if (input.startsWith(Buffer.from([0xc1]))) {
throw new Error('Invalid input: reserved byte 0xc1 detected.');
}
// Proceed with msgpack5 decoding.
Conclusion
The CVE-2026-107299 vulnerability in msgpack5 poses a risk of memory exhaustion due to improper handling of a reserved byte. It is crucial for developers using this library to update to version 6.1.0 or later to mitigate this risk. Implementing the provided workaround can also help in the interim.
See every vulnerability recorded for msgpack5 →
FAQ
The impact includes potential memory exhaustion in applications using msgpack5, which can lead to crashes or degraded performance.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Versions of msgpack5 prior to 6.1.0 are affected by this vulnerability.
Yes, the patch is available in version 6.1.0 of msgpack5. Updating to this version will resolve the issue.
If an immediate update is not possible, implement the workaround to reject the reserved byte '0xc1' before processing input with msgpack5.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
