# CVE-2026-107297: msgpack5 quadratic parsing in streaming decoder

Source: https://junglewise.ai/threats/cve-2026-107297-msgpack5-quadratic-parsing-in-the-streaming-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107297 · Severity: medium · CVSS 5.9 · Published 2026-10-08

msgpack5 is a JavaScript library used to encode and decode MessagePack data, commonly used in networked applications for efficient data serialization. A remote attacker can craft many small chunks of a valid MessagePack value to cause the decoder to repeatedly reparse from the beginning, consuming excessive CPU and blocking the application's event loop, leading to a denial of service.

Technologies: [Mcollina Msgpack5](https://junglewise.ai/threats/technologies/mcollina-msgpack5), [msgpack5 (npm)](https://junglewise.ai/threats/technologies/msgpack5). Vendors: [Mcollina](https://junglewise.ai/threats/vendors/mcollina), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107297 being exploited in the wild.

**How severe is CVE-2026-107297?** Medium severity, with a CVSS score of 5.9, published 8 October 2026.

**Which products and versions are affected?** Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

**Is there a fix for CVE-2026-107297?** Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107297 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107297?** Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- msgpack5 (npm): upgrade to 6.1.0 or later

  ```sh
  npm install msgpack5@6.1.0
  ```


Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.

## Technical details

The streaming decoder exhibits quadratic complexity (CWE-407) when processing incomplete containers because it reparses from the beginning each time a new chunk arrives, rather than preserving state. A remote attacker with network access can split a single valid MessagePack value across many small chunks to trigger worst-case CPU usage and event loop blocking. The vulnerability is fixed in version 6.1.0 by preserving incremental container state.

## Affected products

- mcollina msgpack5 < 6.1.0

## Identifiers

- CVE-2026-107297
- GHSA-gcx5-hxj7-gpqq

## Timeline

- 2026-10-08: disclosed
- 2026-09-26: patched: patch published to npm

## References

- [https://api.github.com/users/SWIFI-AI](https://api.github.com/users/SWIFI-AI)

## Related threats

- [msgpack5 out-of-bounds read in truncated map32 header](https://junglewise.ai/threats/cve-2026-107302-msgpack5-truncated-map32-headers-throw-an-unexpected-error)
- [msgpack5 uncontrolled recursion in streaming decoder](https://junglewise.ai/threats/cve-2026-107300-msgpack5-many-buffered-values-can-exhaust-the-streaming-decoder)
- [msgpack5 unbounded stream buffering via reserved byte](https://junglewise.ai/threats/cve-2026-107299-msgpack5-reserved-byte-can-cause-unbounded-stream-buffering)
- [msgpack5 prototype pollution via partial options](https://junglewise.ai/threats/cve-2026-107301-msgpack5-partial-options-disable-prototype-protection)
- [msgpack5 uncontrolled recursion in decoder](https://junglewise.ai/threats/cve-2026-107298-msgpack5-deeply-nested-input-can-exhaust-the-decoder-stack)