CVE-2023-52079 is a medium-severity (CVSS 6.8) CWE-674 vulnerability in msgpackr. A fix is available for msgpackr — see the affected versions and patch details below.
Conversion of property names to strings can trigger infinite recursion
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-52079.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
msgpackrnpmDescription
msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.
Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | msgpackr | all versions | 1.10.1npm install msgpackr@1.10.1 |
Affected Products
msgpackrkriszypDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for msgpackr, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update msgpackr to 1.10.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-52079 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates this as a moderate impact vulnerability since it demands cloning a structure, which leads to high complexity.
No mitigation is currently found for this CVE.Source: Red Hat security advisory for CVE-2023-52079 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2023-52079 in your dependencies?
Find it across npm, including transitive dependencies.