Description
A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.1.0, < 6.1.0
- Patched version(s): 6.1.0
References
Could your website be exposed too?
SmartScanner can check your website for msgpack5: Truncated map32 headers throw an unexpected error and gives you actionable findings to investigate.
Start a free scanRelated Issues
- enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
- websocket-driver: Message corruption via abuse of protocol length headers - CVE-2026-54466
- ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes - CVE-2026-53496
- Axios: Header Injection via Inherited headers After Minimal Interceptor - CVE-2026-101904
You might also like:
See something that needs correcting? Let us knowUpdated October 19, 2026