HIGH8.6

GHSA-7hpj-7hhx-2fgx

msgpackr's conversion of property names to strings can trigger infinite recursion

Quick fix

GHSA-7hpj-7hhx-2fgx — msgpackr: upgrade to the fixed version with the command below.

npm install msgpackr@1.10.1

Details

### Impact When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.

### Patches The fix is available in v1.10.1

### Workarounds Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

### References

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/msgpackr

Introduced in: 0Fixed in: 1.10.1

Fixnpm install msgpackr@1.10.1

References

https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-52079[ADVISORY]
https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602[WEB]
https://github.com/kriszyp/msgpackr[PACKAGE]