msgpack5 is a MessagePack v5 implementation for node.js and the browser. The vulnerability stems from the array and map decoding paths lacking a nesting‑depth limit. An attacker who can supply MessagePack input may craft deeply nested containers that exhaust the JavaScript call stack, causing the process, worker, or request handler to terminate. This results in a denial of service. The weakness is identified as CWE‑674, indicating an unchecked recursion or loop condition that can lead to stack exhaustion.

The affected product is mcollina’s msgpack5 library for node.js and browser environments. All versions released before 6.1.0 are impacted, as the depth limit was introduced in v6.1.0 and later. Any deployment using these earlier releases is vulnerable.

The CVSS score of 5.3 denotes a moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. An attacker needs the ability to provide MessagePack input to the vulnerable library, which can occur via network requests, local file ingestion, or other mechanisms that deliver serialized data to the application. Exploitation would interrupt process or thread execution, delivering a denial of service. The vulnerability is therefore a moderate risk that can be mitigated by patching.