CVE-2023-52079

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

• CWE-674
• CWE-754
• CWE-674

• https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602Patch
• https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgxVendor Advisory
• https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602Patch
• https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgxVendor Advisory

Published

Dec 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52072FlyCms v1.0 was discovered to contain a Cross-Site Request F…8.8
• CVE-2023-52073FlyCms v1.0 was discovered to contain a Cross-Site Request F…8.8
• CVE-2023-52074FlyCms v1.0 was discovered to contain a Cross-Site Request F…8.8
• CVE-2023-52075ReVanced API proxies requests needed to feed the ReVanced Ma…7.5
• CVE-2023-52076Atril Document Viewer is the default document reader of the …7.8
• CVE-2023-52077Nexkey is a lightweight fork of Misskey v12 optimized for sm…9.8
• CVE-2023-52080IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow …7.7
• CVE-2023-52081ffcss is a CLI interface to apply and configure Firefox CSS …5.3
• CVE-2023-52082Lychee is a free photo-management tool. Prior to 5.0.2, Lyc…9.8
• CVE-2023-52083Winter is a free, open-source content management system. Pr…4.8
• CVE-2023-52084Winter is a free, open-source content management system. Pri…5.4
• CVE-2023-52085Winter is a free, open-source content management system. Use…5.4