Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
azure/msgpack can crash from deeply nested data
published 27 days ago
Summary
The version 3.3.0-1 of azure/msgpack can run out of memory and stop working if it receives specially crafted MessagePack data with many nested containers. This can interrupt a web request or background job that uses the library. Upgrade to version 6.1.0 or later to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | msgpack | <= 3.3.0-1 |
Original advisory text
CVE-2026-107298 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
References
Timeline
Published8 Oct 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
AZL-106860 · OSV
Track software like this
Free during beta