Description
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.1.0
- Patched version(s): 6.1.0
References
Could your website be exposed too?
SmartScanner can check your website for msgpack5: Quadratic parsing in the streaming decoder and gives you actionable findings to investigate.
Start a free scanRelated Issues
- msgpack5: Many buffered values can exhaust the streaming decoder stack - CVE-2026-107300
- msgpack5: Deeply nested input can exhaust the decoder stack - CVE-2026-107298
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - xmldom - CVE-2026-83614
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - CVE-2026-83614
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2026