HeroDevs
Visit NES for .NET Home Page

MessagePack Release Notes

Comprehensive release notes and changelog for MessagePack, including security patches, bug fixes, and feature updates across all supported versions.

25 Patched Vulnerabilities
VEX Statements

2.5.192.x Releases

2.5.192.3 (NES)

Notes

  • This release keeps NES for MessagePack on the 2.5.192.x line while backporting fixes for eight additional upstream MessagePack security advisories, building on the hardening delivered in 2.5.192.2.

Security Fixes

  • MVC input formatter trust boundary: MessagePackInputFormatter now defaults its null/unspecified options to Standard.WithSecurity(UntrustedData) so HTTP request bodies get hash-collision-resistant model binding at the trust boundary instead of falling back to trusted-data defaults.
  • ExpandoObject map size limit: Oversized ExpandoObject maps are now rejected when hash-collision hardening is active, covering both direct deserialization and nested maps from ExpandoObjectResolver, preventing disproportionate CPU consumption from crafted large maps.
  • JSON conversion depth: ConvertFromJson and ConvertToJson now enforce the configured maximum object graph depth across nested objects, arrays, and typeless extension values, and TinyJsonReader skips JSON separators iteratively instead of recursively, preventing stack exhaustion from deeply nested or separator-heavy input.
  • Dynamic union recursion depth: DynamicUnionResolver-emitted deserializers now count the union frame against the object graph depth budget, matching dynamic object formatters, so recursive and skipped unknown union payloads respect the configured depth limit.
  • Unity blit length validation: UnsafeBlitFormatter now parses the extension body through a bounded reader and rejects negative, unaligned, or mismatched byte counts before allocating arrays.
  • Multidimensional array allocation: 2D, 3D, and 4D array formatters now validate non-negative dimensions and confirm the flattened element count matches the serialized header before allocating, preventing disproportionate allocations from malformed dimension values.
  • Security-aware lookup comparer: InterfaceLookupFormatter now passes the security-provided equality comparer into its intermediate dictionary so ILookup<TKey,TElement> deserialization honors UntrustedData hash-collision resistance.
  • Nested typeless blocklist bypass: Typeless deserialization now validates element and constructed generic argument types before resolving a formatter, so container types can no longer hide a disallowed element or generic argument from the blocklist mitigation.

2.5.192.2 (NES)

Notes

Security Fixes

  • LZ4 decompression: Adds bounds checks for crafted LZ4 payloads that could trigger out-of-bounds reads and an AccessViolationException denial of service when deserializing untrusted data with LZ4 compression enabled.
  • LZ4 decompressed-size limit: LZ4 block deserialization now validates each declared uncompressed length against the configured MessagePackSecurity.MaximumDecompressedSize (with a running budget across block-array payloads) before allocating the output buffer, so crafted payloads can no longer request disproportionate allocations ahead of validation.
  • Reader skip depth: MessagePackReader.TrySkip() now skips nested arrays and maps iteratively instead of recursing, so skipping deeply nested untrusted data no longer bypasses the MaximumObjectGraphDepth limit and exhausts the stack.