msgpackr's conversion of property names to strings can trigger infinite recursion
- Severity:
- High
Description
When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.
Recommendation
Update the msgpackr package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.10.1
- Patched version(s): 1.10.1
References
Related Issues
- Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
- Sending a GET or HEAD request with a body crashes SvelteKit (GHSA-g5m6-hxpp-fc49) - CVE-2024-23641
- Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer - CVE-2023-41058
- Tags:
- npm
- msgpackr
Anything's wrong? Let us know Last updated on January 10, 2024