Vulnerabilities

msgpack5 is a msgpack v5 implementation for node.js and the browser.

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

5.3

Fix

available

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-107298 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 20
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 7.5 Fix available CVE-2026-107302 Node.js
2. 13
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 6.5 Fix available CVE-2026-107301 Node.js
3. 20
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 7.5 Fix available CVE-2026-107300 Oracle
4. 13
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 5.9 Fix available CVE-2026-107299 Node.js
5. 13
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 5.9 Fix available CVE-2026-107297 Node.js
6. 10
   CVE NVD 23d ago

   msgpack5 is a msgpack v5 implementation for node.js and the browser.

   CVSS 3.7 Fix available CVE-2026-107296 Node.js