CVE-2026-107300 mcollina CVE debrief

Who should care

Defenders responsible for maintaining systems that use the msgpack5 package should assess exposure and prioritize verification and remediation to prevent potential impacts. Defenders should care about this vulnerability because it can cause a denial of service in systems that use the msgpack5 package, and requires verification and remediation to prevent potential impacts. The vulnerability affects systems that use the msgpack5 package and requires careful

Why it matters

Defenders should care about this vulnerability because it can cause a denial of service in systems that use the msgpack5 package, and requires verification and remediation to prevent potential impacts.

• Denial of service due to JavaScript call stack exhaustion
• Potential interruption of processes or streams
• Need to verify and update msgpack5 to version 6.1.0 or later
• Importance of limiting the number of MessagePack values accepted in one chunk

Technical summary

The msgpack5 package has a vulnerability that can cause a denial of service when processing a chunk with many small MessagePack values. The streaming decoder recursively invokes itself for every complete value remaining in a chunk, which can exhaust the JavaScript call stack and interrupt the process or stream. Defenders should prioritize verifying and updating msgpack5 to version 6.1.0 or later, and limit the number of MessagePack values accepted in one chunk. The vulnerability affects systems that use the msgpack5 package and requires verification and remediation to prevent potential denial of service due to JavaScript call stack exhaustion.

Defensive priority

Defenders should prioritize verifying and updating msgpack5 to version 6.1.0 or later, and limit the number of MessagePack values accepted in one chunk.

Recommended defensive actions

• Verify msgpack5 version and update to 6.1.0 or later
• Limit the number of MessagePack values accepted in one chunk
• Split large batches before passing them to the decoder stream
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the recursive invocation of the streaming decoder for every complete value remaining in a chunk, which can exhaust the JavaScript call stack. This can occur when processing a chunk with many small MessagePack values. The msgpack5 package has a vulnerability that can cause a denial of service in systems that use the package. Defenders should verify and update msgpack5 to version 6.1.0 or later and limit the number of MessagePack values accepted in one chunk.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.