Nerdbank.MessagePack vulnerabilities

1 known vulnerability in Nerdbank.MessagePack from AArnott. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Nerdbank.MessagePack: Memory Allocation with Excessive Size Value

  CVE-2026-44375May 14, 2026AArnott

  Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized times