npm msgpackr vulnerabilities

Latest npm msgpackr CVEs

Newest publication first

1. CVE-2023-52079 Conversion of property names to strings can trigger infinite recursion

   Published 2023-12-28

   Medium·CVSS 6.5 EPSS 0.69%

   msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to requir...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.