msgpack5: Quadratic parsing in streaming decoder (CVE-2026-107297)

What happened

The streaming decoder in msgpack5 reparses an incomplete array or map from the beginning whenever another chunk arrives. If a remote peer splits one valid MessagePack container across many small chunks, completed elements can be decoded repeatedly, producing quadratic CPU use and blocking the event loop. (Sources: 4124, 31825)

Technical cause

The decoder's streaming logic restarts parsing of an incomplete array or map from the start each time a new chunk is appended, rather than resuming at the correct state. That behavior leads to repeated work as data accumulates across chunks, creating quadratic CPU complexity for specially crafted chunking patterns. (Sources: 4124, 31825)

Why it matters

An unauthenticated remote peer can cause high CPU consumption and event-loop blocking by sending a valid MessagePack container split into many small chunks. The CVSS vector indicates an availability impact only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and the computed CVSS base score is 5.9. There are no public exploit reports noted in the sources. (Sources: 4124, 31825)

Who is affected

The npm package msgpack5 is affected. The vulnerability is present in releases introduced at 0 and fixed in 6.1.0; builds that use any release prior to 6.1.0 are affected. Whether an application is exposed depends on whether it decodes MessagePack streams from untrusted or remote peers. (Sources: 4124, 31825)

Discovery and timeline

The issue is published in the OSV entry and NVD record referenced below. OSV published the advisory on 2026-10-08. (Sources: 4124, 31825)

Affected versions

The advisory identifies releases introduced at 0 and fixed in 6.1.0. In other words, releases prior to 6.1.0 are affected; the fix is present in 6.1.0. (Sources: 4124, 31825)

Fixes and mitigation

A vendor update that fixes the streaming decoder logic is available in 6.1.0. The advisory indicates the issue is fixed in that release. No alternate mitigations (such as configuration changes or patches) are documented in the provided sources. (Sources: 4124, 31825)

Recommended action

Update msgpack5 to 6.1.0. If you cannot update immediately, restrict or validate MessagePack input from untrusted or remote peers where possible and monitor event-loop latency and CPU usage in services that decode MessagePack streams. The sources do not list public exploits or proof-of-concept code. (Sources: 4124, 31825)