high8.6
CVE-2023-52079
msgpackr's conversion of property names to strings can trigger infinite recursion
Impact
### Impact When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. ### Patches The fix is available in v1.10.1 ### Workarounds Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue. ### References
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | msgpackr | < 1.10.1 | 1.10.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kriszyp | Msgpackr | before 1.10.1 |