CVE-2026-107297Medium· 5.9▾ Sunlitmsgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
msgpack5 < 6.1.0Patched in:
msgpack5 6.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107302High· 7.5msgpack5 is a msgpack v5 implementation for node.js and the browser
CVE-2026-107300High· 7.5msgpack5 is a msgpack v5 implementation for node.js and the browser
CVE-2026-107301Medium· 6.5msgpack5 is a msgpack v5 implementation for node.js and the browser
CVE-2026-107298Medium· 5.3msgpack5 is a msgpack v5 implementation for node.js and the browser
CVE-2026-107299Medium· 5.9msgpack5 is a msgpack v5 implementation for node.js and the browser
CVE-2026-107296Low· 3.7msgpack5 is a msgpack v5 implementation for node.js and the browser