CVE-2026-107299 — msgpack5 reserved byte can cause unbounded stream buffering

What happened

The streaming decoder in msgpack5 treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When a stream begins with 0xc1, the decoder waits for bytes that cannot make the value valid and leaves subsequent data buffered, allowing a remote peer to cause unbounded buffering and exhaust memory. [sources: 4127, 31827]

Technical cause

The decoder's stream handling logic misclassifies the reserved 0xc1 byte as 'incomplete' rather than an invalid value, so it continues to buffer input while awaiting bytes that cannot produce a valid value. The advisory lists the underlying weakness as CWE-228. [sources: 4127, 31827]

Why it matters

Buffered data can grow without bound when a remote peer begins a stream with 0xc1, enabling memory exhaustion on the decoding side. The advisory notes the issue is reachable from unauthenticated remote inputs and requires no user interaction. [sources: 4127, 31827]

Who is affected

Applications and services that use the msgpack5 library (npm) for MessagePack v5 streaming decoding are affected. [sources: 4127, 31827]

Discovery and timeline

The advisory was published to OSV.dev on 2026-10-08T17:40:01+02:00 and appears in the NVD entry published 2026-10-08T17:17:15+02:00; the advisory record was modified 2026-10-09T16:17:22+02:00. Source records: OSV.dev and NVD. [sources: 4127, 31827]

Affected versions

The package msgpack5 is affected from version 0 up to, but not including, 6.1.0. The vendor provides a fix in 6.1.0. [sources: 4127, 31827]

Fixes and mitigation

A fix is available; the advisory and package claims list 6.1.0 as the fixed version for msgpack5. The advisory marks "fix_available" as true. No other mitigations or workarounds are documented in the provided facts. [sources: 4127, 31827]

Recommended action

Update msgpack5 to the fixed release 6.1.0. The provided facts do not document alternative vendor workarounds; if you cannot update, note that no workaround is listed in the supplied advisory information. [sources: 4127, 31827]