{"cve":"CVE-2023-52079","nvd":{"published":"2023-12-28T16:16:01.863","modified":"2026-06-17T06:42:01.833","status":"Modified","description":"msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.  \nExploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-674","CWE-754"],"references":["https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602","https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx","https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602","https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx"],"products":["kriszyp:msgpackr"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-52079","score":0.00685,"percentile":0.52609,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7hpj-7hhx-2fgx","url":"https://osv.dev/vulnerability/GHSA-7hpj-7hhx-2fgx","summary":"msgpackr's conversion of property names to strings can trigger infinite recursion","modified":"2026-09-10T03:49:59.496313417Z","packages":[{"ecosystem":"npm","name":"msgpackr","purl":"pkg:npm/msgpackr","ranges":["<1.10.1"],"fixed":["1.10.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}