msgpack5 CVE-2026-107302

Exploitation requires the target application to decode attacker-controlled MessagePack input AND to rely on IncompleteBufferError to signal 'wait for more bytes' in an incremental/streaming decode loop - the specific condition named in the advisory. The trigger is a value beginning with 0xdf (map32) whose complete five-byte header has not yet arrived. The limiting factor is that applications which decode only complete buffers, or which already catch generic errors, are not disrupted; there is no exploitation path to data disclosure or code execution, only to an unexpected RangeError that aborts a request, stream, or worker. The documented workaround (require five bytes before decoding 0xdf, or treat RangeError as incomplete input) further narrows real exposure.

This is a denial-of-service vulnerability, not a code-execution or data-exposure flaw. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) correctly scores it as remote, unauthenticated, low-complexity with no confidentiality or integrity impact and high availability impact. The advisory and description agree on the mechanism: a truncated map32 header (byte 0xdf) triggers a bounds-checked out-of-bounds read that throws RangeError instead of the expected IncompleteBufferError, crashing a request, stream, or worker. Critically, both NVD and the GHSA advisory confirm there is NO adjacent-memory disclosure because the buffer implementation enforces bounds - so the input 'Information Disclosure' tag and the CWE-125 'out-of-bounds read' framing overstate the real impact, which is purely availability. No EPSS score, KEV listing, or POC was supplied, so this is 'no public exploit identified at time of analysis'; the A:H rating is also conditional (see exploitation_conditions), meaning real-world risk is lower than the 7.5 base score suggests for most consumers. Verdict: a legitimate but bounded DoS hardening fix, not an urgent widespread-exploitation priority.

An attacker sends a malicious or truncated MessagePack byte stream - specifically a map32 value (0xdf prefix) whose five-byte header is incomplete - to a Node.js service that decodes untrusted input incrementally and relies on IncompleteBufferError to wait for more bytes. Instead of waiting, the decoder throws an unhandled RangeError, terminating the request, stream, or worker and causing a denial of service. No public exploit code was identified in the provided data.