CVE-2026-107299: CWE-228: Improper Handling of Syntactically Invalid Structure in mcollina msgpack5
Description
### Impact The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. ### Patches The decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors. ### Workarounds Reject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.
CVSS v3.1
Score 5.9medium
Affected software
mcollina
msgpack5
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The msgpack5 library for Node.js and browsers, before version 6.1.0, incorrectly processes the reserved MessagePack byte 0xc1 in its streaming decoder. When 0xc1 appears at the start of a stream, the decoder waits for additional bytes to form a valid value, but such bytes cannot make the value valid. This causes the decoder to buffer data continuously, allowing a remote peer to exhaust memory resources. The vulnerability is classified under CWE-228 (Improper Handling of Syntactically Invalid Structure) and has a CVSS 3.1 base score of 5.9.
Potential Impact
A remote attacker can send specially crafted streams beginning with the reserved byte 0xc1 to cause the msgpack5 decoder to buffer data indefinitely, resulting in memory exhaustion and denial of service. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade msgpack5 to version 6.1.0 or later, where this issue is fixed. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T15:53:23.587Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac7d1292cdf04f6562ba9b1
Added to database: 10/08/2026, 17:21:45 UTC
Last enriched: 10/08/2026, 17:33:39 UTC
Last updated: 10/08/2026, 21:48:49 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.