Résumé
msgpack5: Deeply nested input can exhaust the decoder stack
Détails de l’avis
Impact
The decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.
Patches
The decoder now limits nesting depth to 100 by default and throws Maximum decode depth exceeded. Applications can configure the limit with the maxDepth option.
Workarounds
Reject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
- HIGHCVE-2026-58280
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-91968
Vikunja: Unbounded nested task-filter recursion permits API process termination
- MEDIUMCVE-2026-107833
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
- HIGHCVE-2026-107826
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
- HIGHCVE-2026-107300
msgpack5: Many buffered values can exhaust the streaming decoder stack