---
id: "CVE-2026-107302"
kind: "vulnerability"
aliases: ["CVE-2026-107302", "GHSA-8f34-f56x-9xph"]
title: "msgpack5: Truncated map32 headers throw an unexpected error"
severity: "high"
cvss: 7.5
epss: 0.004259999841451645
exploited: false
status: "open"
category: "package"
products: [{"name": "msgpack5", "fixed": ["6.1.0"], "affected": ">= 4.1.0, < 6.1.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-125", "msgpack", "node", "npm", "package", "streaming"]
not_affected_if: ["no-streaming-decode", "version-6.1.0-or-later"]
published_at: "2026-10-08T17:40:10+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T19:56:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8f34-f56x-9xph", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107302", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# msgpack5: Truncated map32 headers throw an unexpected error

msgpack5 versions from 4.1.0 before 6.1.0 throw a RangeError instead of IncompleteBufferError when decoding a truncated map32 header. An attacker who controls the msgpack input can make the decoder throw an unexpected error, which can crash a request, stream, or worker that relies on IncompleteBufferError to wait for more bytes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:msgpack5 affected >= 4.1.0, < 6.1.0 fixed 6.1.0

## How to check

Check the installed msgpack5 version with `npm ls msgpack5`; affected if it is >=4.1.0 and <6.1.0.
Search the code for msgpack5 decode calls that catch IncompleteBufferError to see whether they handle streamed input.

## Fix

Upgrade msgpack5 to 6.1.0 or later.
Until then, require at least five bytes before decoding a value that starts with 0xdf, or catch RangeError for truncated map32 headers only.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-8f34-f56x-9xph
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107302

## From the sources

### Impact

A truncated `map32` header causes an out-of-bounds buffer read and throws `RangeError` instead of `IncompleteBufferError`. Applications that rely on `IncompleteBufferError` to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.

### Patches

The decoder now validates the complete five-byte `map32` header before reading its length and reports truncated input as `IncompleteBufferError`.

### Workarounds

Require at least five bytes before decoding a value beginning with `0xdf`, or catch `RangeError` and treat it as incomplete input only for truncated `map32` headers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_