{"id":"CVE-2026-107302","kind":"vulnerability","aliases":["CVE-2026-107302","GHSA-8f34-f56x-9xph"],"related":[],"title":"msgpack5: Truncated map32 headers throw an unexpected error","description":"### Impact\n\nA truncated `map32` header causes an out-of-bounds buffer read and throws `RangeError` instead of `IncompleteBufferError`. Applications that rely on `IncompleteBufferError` to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.\n\n### Patches\n\nThe decoder now validates the complete five-byte `map32` header before reading its length and reports truncated input as `IncompleteBufferError`.\n\n### Workarounds\n\nRequire at least five bytes before decoding a value beginning with `0xdf`, or catch `RangeError` and treat it as incomplete input only for truncated `map32` headers.","summary":"msgpack5 versions from 4.1.0 before 6.1.0 throw a RangeError instead of IncompleteBufferError when decoding a truncated map32 header. An attacker who controls the msgpack input can make the decoder throw an unexpected error, which can crash a request, stream, or worker that relies on IncompleteBufferError to wait for more bytes.","severity":"high","cvss":7.5,"epss":0.004259999841451645,"exploited":false,"exploited_at":null,"products":[{"name":"msgpack5","fixed":["6.1.0"],"affected":">= 4.1.0, < 6.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-125","msgpack","node","npm","package","streaming"],"not_affected_if":["no-streaming-decode","version-6.1.0-or-later"],"how_to_check":"Check the installed msgpack5 version with `npm ls msgpack5`; affected if it is >=4.1.0 and <6.1.0.\nSearch the code for msgpack5 decode calls that catch IncompleteBufferError to see whether they handle streamed input.","fix":"Upgrade msgpack5 to 6.1.0 or later.\nUntil then, require at least five bytes before decoding a value that starts with 0xdf, or catch RangeError for truncated map32 headers only.","status":"open","published_at":"2026-10-08T17:40:10+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T19:56:09+00:00","updated_at":"2026-10-23T19:56:09+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:56:09Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade msgpack5 to 6.1.0 or later.\nUntil then, require at least five bytes before decoding a value that starts with 0xdf, or catch RangeError for truncated map32 headers only.","summary":"msgpack5 versions from 4.1.0 before 6.1.0 throw a RangeError instead of IncompleteBufferError when decoding a truncated map32 header. An attacker who controls the msgpack input can make the decoder throw an unexpected error, which can crash a request, stream, or worker that relies on IncompleteBufferError to wait for more bytes.","category":"package","who_cares":["npm","node","streaming","msgpack"],"confidence":0.85,"analyst_note":"","how_to_check":"Check the installed msgpack5 version with `npm ls msgpack5`; affected if it is >=4.1.0 and <6.1.0.\nSearch the code for msgpack5 decode calls that catch IncompleteBufferError to see whether they handle streamed input.\nunknown","needs_analyst":false,"not_affected_if":["version-6.1.0-or-later","no-streaming-decode"],"severity_if_unknown":"unknown"},"cost_usd":0.000422,"input_tokens":2206,"output_tokens":403,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107302':11A,19A '-125':22B '-2026':10A,18A '0xdf':160C '4.1.0':31B '6.1.0':33B '8f34':14A '9xph':16A 'addit':105C 'adjac':116C 'applic':97C 'attack':47B 'begin':158C 'bound':88C,125C 'buffer':89C,122C 'byte':77B,106C,135C,153C 'catch':162C 'caus':83C 'check':124C 'complet':132C 'control':49B 'crash':63B 'cve':9A,17A 'cwe':21B 'decod':41B,56B,128C,155C 'disclos':119C 'error':8A,60B 'f56x':15A 'five':134C,152C 'five-byt':133C 'ghsa':13A 'ghsa-8f34-f56x-9xph':12A 'header':4A,45B,82C,137C,174C 'impact':78C 'implement':123C 'incomplet':168C 'incompletebuffererror':39B,72B,96C,101C,147C 'input':52B,145C,169C 'instead':37B,94C 'least':151C 'length':141C 'make':54B 'map32':3A,44B,81C,136C,173C 'may':107C 'memori':117C 'msgpack':23B,51B 'msgpack5':1A,20A,28B 'node':24B 'npm':25B 'out-of-bound':85C 'packag':26B 'patch':126C 'rangeerror':36B,93C,163C 'read':90C,139C 'reli':70B,99C 'report':143C 'request':65B,110C 'requir':149C 'stream':27B,66B,111C 'termin':108C 'throw':5A,34B,57B,92C 'treat':165C 'truncat':2A,43B,80C,144C,172C 'unexpect':7A,59B,114C 'valid':130C 'valu':157C 'version':29B 'wait':74B,103C 'workaround':148C 'worker':68B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T17:40:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8f34-f56x-9xph","url":"https://github.com/advisories/GHSA-8f34-f56x-9xph","severity":"high","published_at":"2026-10-08T17:40:10+00:00","modified_at":"2026-10-19T19:29:00+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107302","severity":null,"published_at":"2026-10-08T18:17:19+00:00","modified_at":"2026-10-19T20:17:47+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}