Msgpack5
Monthly
Decoding a truncated map32 MessagePack value in msgpack5 (npm) before 6.1.0 causes the decoder to read the four-byte length field of a five-byte header that has not fully arrived, producing an out-of-bounds buffer read that throws RangeError instead of IncompleteBufferError; the unauthenticated network-vector flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) can abort a request, stream, or worker in applications that use IncompleteBufferError to decide whether to wait for more bytes. Impact is denial of service only - the underlying buffer implementation bounds-checks the read, so there is no adjacent-memory disclosure and no path to code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (6.1.0).
msgpack5 is a msgpack v5 implementation for node.js and the browser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Decoding a truncated map32 MessagePack value in msgpack5 (npm) before 6.1.0 causes the decoder to read the four-byte length field of a five-byte header that has not fully arrived, producing an out-of-bounds buffer read that throws RangeError instead of IncompleteBufferError; the unauthenticated network-vector flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) can abort a request, stream, or worker in applications that use IncompleteBufferError to decide whether to wait for more bytes. Impact is denial of service only - the underlying buffer implementation bounds-checks the read, so there is no adjacent-memory disclosure and no path to code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (6.1.0).
msgpack5 is a msgpack v5 implementation for node.js and the browser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.