Conversion of property names to strings can trigger infinite recursion

published 2023-12-28 2 y ago modified 2026-09-10 1 mo ago also GHSA-7hpj-7hhx-2fgx , EUVD-2023-3146

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

Patch / fix

fixed in 2 links 1

npm msgpackr 1.10.1
kriszyp msgpackr 1.10.1

github.com/kriszyp/msgpackr@18f44f8 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-52079 updated 2026-08-04 cvss 5.9

msgpackr: crafted message leads to Denial of Service

Red Hat Fuse 7 msgpackr
affected: workaround, no fix planned “No mitigation is currently found for this CVE.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-27)

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	msgpackr	<1.10.1	1.10.1

Affected products

kriszyp msgpackr

Classification

Weakness

CWE-674 Uncontrolled Recursion
CWE-754 Improper Check for Unusual or Exceptional Conditions

References

github.com /kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602
web, patch
github.com /kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2023-52079
advisory
github.com /kriszyp/msgpackr
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary