Quick answers
- Is CVE-2026-107300 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107300 being exploited in the wild.
- How severe is CVE-2026-107300?
- High severity, with a CVSS score of 7.5, published 8 October 2026.
- Which products and versions are affected?
- Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.
- Is there a fix for CVE-2026-107300?
- Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107300 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-107300?
- Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- msgpack5 (npm): upgrade to 6.1.0 or later
npm install msgpack5@6.1.0
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
Technical details
The streaming decoder uses uncontrolled recursion (CWE-674) to process multiple concatenated MessagePack values in a single chunk, with each value triggering a recursive call. An attacker can craft a malicious chunk containing many small valid values to exhaust the JavaScript call stack and crash the decoder. The fix refactors the decoder to use iteration instead of recursion, maintaining constant stack depth.
Affected products
- mcollina msgpack5 < 6.1.0
Identifiers
- CVE-2026-107300
- GHSA-5x5g-h9x8-2fh9
Timeline
- 2026-09-26: disclosed
- 2026-10-08: advisory
- 2026-09-26: patched