msgpack5: Deeply nested input can exhaust the decoder stack

{
  "id": "0b4de3816e2f3f313b27f0bf6776cbbbec183d68d37279b7108fc31ab182b986",
  "url": "https://osv.dev/vulnerability/GHSA-24ch-f2g6-9hhh",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "msgpack5: Deeply nested input can exhaust the decoder stack",
    "summary": "### Impact The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler. ### Patches The decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option. ### Workarounds Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.",
    "evidence": "osv:GHSA-24ch-f2g6-9hhh",
    "products": [
      {
        "name": {
          "value": "msgpack5",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-24ch-f2g6-9hhh",
      "aliases": [
        "CVE-2026-107298",
        "GHSA-24ch-f2g6-9hhh"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.1.0"
                }
              ]
            }
          ],
          "package": {
            "name": "msgpack5",
            "purl": "pkg:npm/msgpack5",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-24ch-f2g6-9hhh/GHSA-24ch-f2g6-9hhh.json"
          }
        }
      ],
      "modified": "2026-10-08T18:00:09.700213613Z",
      "provider": "osv",
      "references": [
        "https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh",
        "https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102",
        "https://github.com/mcollina/msgpack5",
        "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-674"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-08T17:39:51Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107298",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 104435,
  "published_at": "2026-10-08T17:39:51+00:00"
}