msgpack5 CVE-2026-107298

The application must decode attacker-controllable MessagePack input using msgpack5 before version 6.1.0 without first bounding nesting depth. No authentication, user interaction, or non-default configuration is required - versions prior to 6.1.0 had no depth limit at all. Exploitation is LIMITED to availability impact (process/worker/request-handler crash) with no data or integrity consequences, and is mitigated where the application already rejects deeply nested input, isolates decoding in a worker, or enforces a bounded trusted schema. After 6.1.0 the default maxDepth of 100 blocks the attack unless an operator explicitly raises the limit.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is internally consistent with the description: a remote, unauthenticated attacker (PR:N) who can supply MessagePack input triggers unbounded recursion in the array/map decoder, exhausting the JavaScript call stack. All impact is confined to availability (A:L, with C:N/I:N) - there is no data exposure or code execution, so the input 'Information Disclosure' tag contradicts the actual impact and appears mislabeled (see data_quality_flags). No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation. The A:L (rather than A:H) rating reflects that the attack interrupts a single process/worker/request handler rather than causing sustained infrastructure-wide outage; in a Node.js service that does not isolate decoding, a crash can still take down a request handler or worker. Overall this is a real but bounded availability risk that warrants routine patching rather than emergency response.

An attacker sends a small, crafted MessagePack payload containing hundreds of deeply nested arrays or maps to an endpoint of a Node.js service that decodes untrusted MessagePack using msgpack5 < 6.1.0. The recursive decoder descends one frame per nesting level and exhausts the call stack, throwing an uncatchable RangeError that crashes the process, worker, or request handler. No public proof-of-concept is referenced, but the payload is trivial to construct from the public advisory.