CVE-2026-107298: msgpack5: Deeply nested input can exhaust the decoder stack

October 8, 2026

The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.

References

github.com/advisories/GHSA-24ch-f2g6-9hhh
github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102
github.com/mcollina/msgpack5/releases/tag/v6.1.0
github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh
nvd.nist.gov/vuln/detail/CVE-2026-107298

Code Behaviors & Features

Detect and mitigate CVE-2026-107298 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →