CVE-2023-52079

MEDIUM

msgpackr < 1.10.1 - Denial of Service via Crafted MessagePack Message

Title source: llm
STIX 2.1

Description

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

References (2)

Core 2

Scores

CVSS v3 6.8
EPSS 0.0069
EPSS Percentile 47.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-754 CWE-674
Status published
Products (2)
kriszyp/msgpackr < 1.10.1
npm/msgpackr 0 - 1.10.1npm
Published Dec 28, 2023
Tracked Since Feb 18, 2026