msgpack5 EUVD-2026-95111

Exploitation requires the application to use msgpack5's streaming decoder interface (the decoder stream backed by Decoder.prototype._transform) and to feed it data originating from an untrusted remote peer; the synchronous one-shot decode() path is not the affected surface. Once the streaming decoder is exposed to attacker-controlled input, no authentication, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N) - a single chunk containing many small valid values suffices. The principal limiting factors are therefore architectural: applications must (a) use the streaming decoder rather than one-shot decode, and (b) expose it to untrusted/remote input; services that only parse trusted or locally-generated MessagePack are not realistically exploitable.

This is a genuine but bounded denial-of-service issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a remote, unauthenticated peer can crash the process with low attack complexity, and the impact is purely availability (C:N/I:N - no data exposure). No EPSS score, no CISA KEV listing, and no public POC were supplied in the intelligence set, so there is no evidence of active or automated exploitation - this is a high-CVSS issue driven entirely by the ease of a remote crash, not by observed in-the-wild activity. The root cause (CWE-674 uncontrolled recursion) is confirmed by the fix commit, which replaces the self-recursive _transform call with an iterative while loop. One clear metadata conflict must be flagged: the input Tag 'Information Disclosure' directly contradicts the CVSS (C:N) and the description, which describe a pure availability/DoS flaw with no confidentiality impact - this appears to be a mislabeled tag and should not drive triage. Real-world priority is moderate: patch promptly where the streaming decoder is exposed to untrusted input, but the lack of KEV/EPSS/POC signals suggests this is not an urgent mass-exploitation threat.

An attacker who can send data to a Node.js service that pipes an untrusted network stream through msgpack5's streaming decoder crafts a single chunk containing a large number of small, individually valid MessagePack values. Because the decoder recurses once per remaining value in the chunk, the attacker triggers deep recursion that exhausts the V8 call stack, throwing a RangeError and crashing the process or killing the stream. No authentication or user interaction is needed (AV:N/AC:L/PR:N/UI:N); no public exploit code was identified, but the fix commit is public and the technique is trivial to reproduce.