Detections
Analytics

SCA: security update for msgpack5 (GHSA-gcx5-hxj7-gpqq)

medium Tenable Self-Hosted Container Security Plugin ID 473868

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder
 reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can
 split one valid MessagePack container across many small chunks, causing completed elements to be decoded
 repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
 (CVE-2026-107297)

Solution

Update the msgpack5 library and its related packages to version 6.1.0 or later.

See Also

https://github.com/advisories/GHSA-gcx5-hxj7-gpqq

Plugin Details

Severity: Medium

ID: 473868

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/8/2026

Updated: 10/8/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-107297

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-107297

cwe: CWE-407