GHSA-7hpj-7hhx-2fgx

msgpackr's conversion of property names to strings can trigger infinite recursion

Source: GitHub Advisory Database (reviewed) High CVE-2023-52079

Packages

Ecosystem	Package	Affected	Fixed in
npm	msgpackr	< 1.10.1	1.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. ### Patches The fix is available in v1.10.1 ### Workarounds Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue. ### References

References

External links from the advisory. They lead to third-party sites.

https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx web
https://nvd.nist.gov/vuln/detail/CVE-2023-52079 advisory
https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602 web
https://github.com/kriszyp/msgpackr package