CVE-2023-52079: 
JavaScript vulnerability analysis and mitigation

msgpackr, a fast MessagePack NodeJS/JavaScript implementation, was found to contain a vulnerability (CVE-2023-52079) prior to version 1.10.1. The vulnerability was discovered when decoding user-supplied MessagePack messages, where attackers could trigger stuck threads by crafting messages that keep the decoder stuck in a loop (GitHub Advisory).

The vulnerability is related to uncontrolled recursion (CWE-674) and improper check for unusual or exceptional conditions (CWE-754) in the message decoding process. The CVSS v3.1 base score is 6.5 (MEDIUM) according to NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while GitHub rates it at 6.8 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is on system availability. When successfully exploited, the vulnerability can cause threads to become stuck in a loop, potentially leading to a denial of service condition (GitHub Advisory).

The vulnerability requires the ability to send specially crafted MessagePack messages to the target system. Exploits typically require structured cloning to be successful (GitHub Advisory).

The vulnerability has been patched in version 1.10.1 of msgpackr. As a workaround, users can replace the 0x70 extension with a custom extension that throws an error or performs an action other than recursive referencing (GitHub Advisory, GitHub Patch).