CVE-2023-52079: msgpackr's conversion of property names to strings can trigger infinite recursion
8.6
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.55893%
CWE
Published
12/28/2023
Updated
1/10/2024
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| msgpackr | npm | < 1.10.1 | 1.10.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from unsafe toString() conversions in two locations:
- In readKey(), where read().toString() could process malicious objects with recursive toString() implementations
- In recordDefinition's structure mapping, where property.toString() allowed arbitrary object conversion Both were patched by replacing toString() with asSafeString() which restricts input types. The commit diff shows these critical replacements, confirming these functions as the attack surface for uncontrolled recursion via crafted property names.