CVE-2026-107298: CWE-674: Uncontrolled Recursion in mcollina msgpack5
Description
### Impact The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler. ### Patches The decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option. ### Workarounds Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.
CVSS v3.1
Score 5.3medium
Affected software
mcollina
msgpack5
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The msgpack5 library versions before 6.1.0 lack a nesting-depth limit in their array and map decoding paths. An attacker able to provide crafted MessagePack input can exploit this by submitting deeply nested containers, which leads to uncontrolled recursion and exhaustion of the JavaScript call stack. This results in interruption of the affected process, worker, or request handler. The vulnerability is identified as CWE-674 (Uncontrolled Recursion). The issue has been addressed and fixed in msgpack5 version 6.1.0.
Potential Impact
Exploitation of this vulnerability results in denial of service by exhausting the JavaScript call stack, interrupting processes or request handlers that use vulnerable versions of msgpack5. There is no impact on confidentiality or integrity. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.
Mitigation Recommendations
Upgrade to msgpack5 version 6.1.0 or later, where the nesting-depth limit has been implemented to prevent uncontrolled recursion. No other mitigation is required as the issue is fixed in this version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T15:53:23.587Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac7d1292cdf04f6562ba9b0
Added to database: 10/08/2026, 17:21:45 UTC
Last enriched: 10/08/2026, 17:33:43 UTC
Last updated: 10/08/2026, 21:48:49 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.