CVE-2023-52079: Conversion of property names to strings can trigger infinite recursion
Vulnerability summary
CVE-2023-52079 is a medium (CVSS 6.8) Uncontrolled Recursion vulnerability in kriszyp msgpackr. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 28-12-2023PublishedVulnerability first disclosed.
- 27-08-2024Last modifiedVulnerability information updated.
Description
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.69% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Kriszyp1 product
- msgpackr< 1.10.1
Npm1 product
- msgpackr< 1.10.1
2 vendors · 2 products
References
4 links- github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgxX Refsource CONFIRMWEBVendor Advisory
- github.com/kriszyp/msgpackrPACKAGE