msgpackr's conversion of property names to strings can trigger infinite recursion

Description

When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.

Recommendation

Update the msgpackr package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.1
• Patched version(s): 1.10.1

References

• GHSA-7hpj-7hhx-2fgx
• CVE-2023-52079
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
• Sandbox escape via infinite recursion and error objects - CVE-2026-25533
• Sandbox escape via infinite recursion and error objects (GHSA-x39w-8vm5-5m3p) - CVE-2026-25533
• Svelecte item names vulnerable to execution of arbitrary JavaScript - CVE-2023-38687

Tags:

npm

msgpackr