# CVE-2026-107302: msgpack5 out-of-bounds read in truncated map32 header

Source: https://junglewise.ai/threats/cve-2026-107302-msgpack5-truncated-map32-headers-throw-an-unexpected-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107302 · Severity: high · CVSS 7.5 · Published 2026-10-08

msgpack5 is a JavaScript library for encoding and decoding MessagePack data, a binary serialization format commonly used in APIs and data processing pipelines. A malformed or truncated message with a truncated map32 header causes the decoder to throw an unexpected error that crashes the application instead of waiting for more data, resulting in denial of service by terminating requests, streams, or worker processes.

Technologies: [Mcollina Msgpack5](https://junglewise.ai/threats/technologies/mcollina-msgpack5), [msgpack5 (npm)](https://junglewise.ai/threats/technologies/msgpack5). Vendors: [Mcollina](https://junglewise.ai/threats/vendors/mcollina), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107302 being exploited in the wild.

**How severe is CVE-2026-107302?** High severity, with a CVSS score of 7.5, published 8 October 2026.

**Which products and versions are affected?** Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

**Is there a fix for CVE-2026-107302?** Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Require at least five bytes before decoding any value beginning with 0xdf, or catch RangeError and treat it as incomplete input specifically for truncated map32 headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107302 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107302?** Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- msgpack5 (npm): upgrade to 6.1.0 or later

  ```sh
  npm install msgpack5@6.1.0
  ```


Require at least five bytes before decoding any value beginning with 0xdf, or catch RangeError and treat it as incomplete input specifically for truncated map32 headers.

## Technical details

A truncated five-byte map32 header (0xdf) triggers an out-of-bounds buffer read that throws RangeError instead of the expected IncompleteBufferError. This occurs because the decoder does not validate that the complete header is present before attempting to read its length. An attacker sends a network packet with incomplete MessagePack data; applications relying on IncompleteBufferError for backpressure handling experience unexpected termination. No memory disclosure occurs due to JavaScript buffer bounds checking.

## Affected products

- mcollina msgpack5 < 6.1.0

## Identifiers

- CVE-2026-107302
- GHSA-8f34-f56x-9xph

## Timeline

- 2026-10-08: disclosed: GitHub Advisory published
- 2026-09-26: patched: Version 6.1.0 released with fix

## References

- [https://api.github.com/users/SWIFI-AI](https://api.github.com/users/SWIFI-AI)

## Related threats

- [msgpack5 uncontrolled recursion in streaming decoder](https://junglewise.ai/threats/cve-2026-107300-msgpack5-many-buffered-values-can-exhaust-the-streaming-decoder)
- [msgpack5 unbounded stream buffering via reserved byte](https://junglewise.ai/threats/cve-2026-107299-msgpack5-reserved-byte-can-cause-unbounded-stream-buffering)
- [msgpack5 prototype pollution via partial options](https://junglewise.ai/threats/cve-2026-107301-msgpack5-partial-options-disable-prototype-protection)
- [msgpack5 uncontrolled recursion in decoder](https://junglewise.ai/threats/cve-2026-107298-msgpack5-deeply-nested-input-can-exhaust-the-decoder-stack)
- [msgpack5 quadratic parsing in streaming decoder](https://junglewise.ai/threats/cve-2026-107297-msgpack5-quadratic-parsing-in-the-streaming-decoder)