Description
The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.1.0
- Patched version(s): 6.1.0
References
Could your website be exposed too?
SmartScanner can check your website for msgpack5: Deeply nested input can exhaust the decoder stack and gives you actionable findings to investigate.
Start a free scanRelated Issues
- msgpack5: Many buffered values can exhaust the streaming decoder stack - CVE-2026-107300
- joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas - CVE-2026-48038
- yaml is vulnerable to Stack Overflow via deeply nested YAML collections - CVE-2026-33532
- stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop - CVE-2026-71429
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2026