msgpackr's conversion of property names to strings can trigger infinite recursion

Description

When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.

Recommendation

Update the msgpackr package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.1
• Patched version(s): 1.10.1

References

• GHSA-7hpj-7hhx-2fgx
• CVE-2023-52079
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
• Svelecte item names vulnerable to execution of arbitrary JavaScript - CVE-2023-38687
• Hidden fields can be leaked on readable collections in Payload - CVE-2023-30843
• matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700

Tags:

npm

msgpackr