msgpack5 CVE-2026-107297

Exploitation requires the application to use msgpack5's streaming Decoder (the decoder() stream / _transform path) and to feed it data from an untrusted remote peer who controls how the byte stream is fragmented into chunks. The limiting factors are significant: the attacker must be able to split a single valid MessagePack array or map container across many small chunks (hence CVSS AC:H), and applications that buffer each complete MessagePack value before decoding, or that decode only from trusted sources, are not exposed. Versions prior to 6.1.0 are affected; 6.1.0 preserves incremental container state so completed elements are not reparsed. Impact is limited to CPU exhaustion / event-loop blocking (availability) with no confidentiality or integrity effect.

This is a moderate-severity denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) correctly captures a remote, unauthenticated, availability-only impact (CWE-407, algorithmic complexity) with high attack complexity - the AC:H reflects that the attacker must control chunk fragmentation to trigger the quadratic reparse rather than any memory-corruption timing. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data supplied. The realistic priority is lower than a typical CVSS 5.9 might suggest: impact is confined to CPU exhaustion / event-loop blocking (a availability hit, recoverable on connection close), there is no data exposure or code execution, and exploitation requires the application to specifically use the streaming decoder on attacker-controlled chunked input. The input Tag 'Information Disclosure' contradicts the vector (C:N, I:N) and the GHSA summary (a parsing DoS) - this appears to be a mislabeling, not a confidentiality concern.

A Node.js service uses msgpack5's streaming decoder to parse MessagePack data arriving over a network socket from untrusted peers. A malicious peer sends one valid array or map container but delivers it one byte (or a few bytes) at a time, so each arriving chunk forces the decoder to reparse all previously completed elements from the beginning, producing quadratic CPU growth that pins the event loop and starves all other clients. No public exploit code was identified, but the technique is straightforward given AC:H only reflects the need to control chunk boundaries.