msgpack5 vulnerabilities

2 known vulnerabilities in msgpack5 from Mcollina. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  msgpack5: Out-of-bounds Read

  CVE-2026-107302Oct 8, 2026Mcollina

  msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked

• 7.5 High severity

  msgpack5: Uncontrolled Recursion

  CVE-2026-107300Oct 8, 2026Mcollina

  msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values,