https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 03:32:54 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107300 <p>msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.</p> <p>msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107300 https://vulnerability.circl.lu/vuln/ghsa-5x5g-h9x8-2fh9 <p><strong>Affected:</strong> npm: msgpack5</p> <p>### Impact</p> <p>The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.</p> <p>### Patches</p> <p>The streaming decoder now drains concatenated values iteratively with constant call-stack depth.</p> <p>### Workarounds</p> <p>Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.</p> <p><strong>Affected:</strong> npm: msgpack5</p> <p>### Impact</p> <p>The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.</p> <p>### Patches</p> <p>The streaming decoder now drains concatenated values iteratively with constant call-stack depth.</p> <p>### Workarounds</p> <p>Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.</p> https://vulnerability.circl.lu/vuln/ghsa-5x5g-h9x8-2fh9