Skip to main content

Uncontrolled Recursion


Severity Medium
Score 6.5/10


The package msgpackr is a fast MessagePack NodeJS/JavaScript implementation. In msgpackr package versions prior to 1.10.1, when decoding user-supplied "MessagePack" messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. Exploits seem to require structured cloning, replacing the "0x70" extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

  • LOW
  • NONE
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-674 - Uncontrolled Recursion

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.


Advisory Timeline

  • Published