msgpack5: Reserved byte can cause unbounded stream buffering
Impact
The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.
Patches
The decoder now rejects 0xc1 as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.
Workarounds
Reject 0xc1 before streaming input to msgpack5, and enforce stream byte and time limits.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | msgpack5 | < 6.1.0 | 6.1.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-228- Platform
- npm
- Package
msgpack5- Disclosed
- 08.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-26wq-p25c-j6fv - CC BY 4.0
Vulnerability history: msgpack5
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 03.2021 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 5
- Low 1
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 7
-
msgpack5: Reserved byte can cause unbounded stream buffering this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.