CVE-2026-107302: msgpack5 - Out-of-Bounds Read Due to Truncated map32 Header
Summary
CVE-2026-107302: msgpack5: Truncated map32 headers throw an unexpected error. Affects msgpack5 versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
msgpack5 is a popular JavaScript library used for encoding and decoding MessagePack data format, which is a binary format that is efficient for data serialization. It is widely utilized in applications that require fast data exchange. However, it has a vulnerability that can lead to unexpected errors when handling truncated map32 headers, potentially affecting application stability.
Vulnerability Detail
The vulnerability arises from a truncated map32 header that causes an out-of-bounds buffer read. Instead of throwing an IncompleteBufferError, it throws a RangeError. This can lead to applications that depend on IncompleteBufferError to handle incomplete data to terminate requests, streams, or workers unexpectedly. Although no adjacent memory is disclosed due to buffer implementation checks, the impact on application flow can be significant.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that at least five bytes are required before decoding a value that begins with 0xdf. Alternatively, you can catch the RangeError and treat it as incomplete input specifically for truncated map32 headers. Here is an example of how to implement this in your code:
try {
// Your decoding logic here
} catch (error) {
if (error instanceof RangeError) {
// Handle as incomplete input
}
}
Conclusion
In summary, the msgpack5 library has a vulnerability related to truncated map32 headers that can lead to unexpected application behavior. It is crucial to update to version 6.1.0 or later to mitigate this risk. Additionally, implementing workarounds can help manage the issue until an update is applied.
See every vulnerability recorded for msgpack5 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If left unaddressed, this vulnerability can lead to unexpected application behavior, including crashes or termination of processes relying on the msgpack5 library.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
A map32 header is part of the MessagePack format that indicates the beginning of a map structure with a size of up to 2^32 elements.
No adjacent memory is disclosed due to the buffer implementation checks, so there is no risk of data leakage, but application stability may be compromised.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
