Live › vulnerability › CVE-2026-107302
Go to dashboardmsgpack5 versions from 4.1.0 before 6.1.0 throw a RangeError instead of IncompleteBufferError when decoding a truncated map32 header. An attacker who controls the msgpack input can make the decoder throw an unexpected error, which can crash a request, stream, or worker that relies on IncompleteBufferError to wait for more bytes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| msgpack5 | npm | >= 4.1.0, < 6.1.0 | 6.1.0 |
Check the installed msgpack5 version with npm ls msgpack5; affected if it is >=4.1.0 and <6.1.0.
Search the code for msgpack5 decode calls that catch IncompleteBufferError to see whether they handle streamed input.
6.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.
The decoder now validates the complete five-byte map32 header before reading its length and reports truncated input as IncompleteBufferError.
Require at least five bytes before decoding a value beginning with 0xdf, or catch RangeError and treat it as incomplete input only for truncated map32 headers.
This page as .md · .json · in your agent: get_signal("CVE-2026-107302")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.