Is CVE-2026-107302 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107302 being exploited in the wild.

How severe is CVE-2026-107302?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Which products and versions are affected?

Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

How is CVE-2026-107302 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107302?

Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107302: msgpack5 out-of-bounds read in truncated map32 header

Q: Which products and versions are affected?

Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

Q: Is there a fix for CVE-2026-107302?

Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Require at least five bytes before decoding any value beginning with 0xdf, or catch RangeError and treat it as incomplete input specifically for truncated map32 headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107302 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107302?

Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107302 · Severity: high · CVSS 7.5 · Published 2026-10-08

msgpack5 is a JavaScript library for encoding and decoding MessagePack data, a binary serialization format commonly used in APIs and data processing pipelines. A malformed or truncated message with a truncated map32 header causes the decoder to throw an unexpected error that crashes the application instead of waiting for more data, resulting in denial of service by terminating requests, streams, or worker processes.

Technologies: Mcollina Msgpack5, msgpack5 (npm). Vendors: Mcollina, npm.

Quick answers

Is CVE-2026-107302 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107302 being exploited in the wild.
How severe is CVE-2026-107302?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.
Is there a fix for CVE-2026-107302?: Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Require at least five bytes before decoding any value beginning with 0xdf, or catch RangeError and treat it as incomplete input specifically for truncated map32 headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107302 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107302?: Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

msgpack5 (npm): upgrade to 6.1.0 or later
```
npm install msgpack5@6.1.0
```

Require at least five bytes before decoding any value beginning with 0xdf, or catch RangeError and treat it as incomplete input specifically for truncated map32 headers.

Technical details

A truncated five-byte map32 header (0xdf) triggers an out-of-bounds buffer read that throws RangeError instead of the expected IncompleteBufferError. This occurs because the decoder does not validate that the complete header is present before attempting to read its length. An attacker sends a network packet with incomplete MessagePack data; applications relying on IncompleteBufferError for backpressure handling experience unexpected termination. No memory disclosure occurs due to JavaScript buffer bounds checking.

Affected products

mcollina msgpack5 < 6.1.0

Identifiers

CVE-2026-107302
GHSA-8f34-f56x-9xph

Timeline

2026-10-08: disclosed: GitHub Advisory published
2026-09-26: patched: Version 6.1.0 released with fix

References

https://api.github.com/users/SWIFI-AI

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.