MessagePack Release Notes

2.5.192.x Releases

2.5.192.4 (NES)

Notes

This release keeps NES for MessagePack on the 2.5.192.x line while backporting fixes for three upstream MessagePack security advisories published in October 2026, building on the hardening delivered in 2.5.192.3.

Security Fixes

Nested container allocations: MessagePackReader now tracks the minimum bytes still owed by every open array and map header, so nested headers can no longer each claim the same unread bytes to justify an allocation. A small crafted payload could previously force large allocations before any elements were read.
- Fixes a memory-exhaustion denial-of-service vulnerability (CVE-2026-92707).
Assembly-name regex: AssemblyNameVersionSelectorRegex now escapes the literal periods in its pattern, removing the catastrophic backtracking that crafted type names could trigger.
- Fixes a regular-expression denial-of-service vulnerability (GHSA-fx6j-x9m5-vmrf).
LZ4 length accumulation: Both LZ4 decoders now reject literal and match lengths larger than the remaining destination capacity before adding them up or copying, so crafted lengths can no longer overflow and crash the process with an AccessViolationException.
- Fixes a high-severity process-crash denial-of-service vulnerability (GHSA-7rj2-5w9w-r9jx).

2.5.192.3 (NES)

Notes

This release keeps NES for MessagePack on the 2.5.192.x line while backporting fixes for eight additional upstream MessagePack security advisories, building on the hardening delivered in 2.5.192.2.

Security Fixes

MVC input formatter trust boundary: MessagePackInputFormatter now defaults its null/unspecified options to Standard.WithSecurity(UntrustedData) so HTTP request bodies get hash-collision-resistant model binding at the trust boundary instead of falling back to trusted-data defaults.
- Fixes an insecure-default-deserialization vulnerability (CVE-2026-48509).
ExpandoObject map size limit: Oversized ExpandoObject maps are now rejected when hash-collision hardening is active, covering both direct deserialization and nested maps from ExpandoObjectResolver, preventing disproportionate CPU consumption from crafted large maps.
- Fixes a hash-collision / resource-consumption denial-of-service vulnerability (CVE-2026-48511).
JSON conversion depth: ConvertFromJson and ConvertToJson now enforce the configured maximum object graph depth across nested objects, arrays, and typeless extension values, and TinyJsonReader skips JSON separators iteratively instead of recursively, preventing stack exhaustion from deeply nested or separator-heavy input.
- Fixes an uncontrolled-recursion denial-of-service vulnerability (CVE-2026-48512).
Dynamic union recursion depth: DynamicUnionResolver-emitted deserializers now count the union frame against the object graph depth budget, matching dynamic object formatters, so recursive and skipped unknown union payloads respect the configured depth limit.
- Fixes an uncontrolled-recursion denial-of-service vulnerability (CVE-2026-48513).
Unity blit length validation: UnsafeBlitFormatter now parses the extension body through a bounded reader and rejects negative, unaligned, or mismatched byte counts before allocating arrays.
- Fixes a memory-allocation denial-of-service vulnerability (CVE-2026-48514).
Multidimensional array allocation: 2D, 3D, and 4D array formatters now validate non-negative dimensions and confirm the flattened element count matches the serialized header before allocating, preventing disproportionate allocations from malformed dimension values.
- Fixes a memory-allocation denial-of-service vulnerability (CVE-2026-48515).
Security-aware lookup comparer: InterfaceLookupFormatter now passes the security-provided equality comparer into its intermediate dictionary so ILookup<TKey,TElement> deserialization honors UntrustedData hash-collision resistance.
- Fixes a hash-collision denial-of-service vulnerability (CVE-2026-48516).
Nested typeless blocklist bypass: Typeless deserialization now validates element and constructed generic argument types before resolving a formatter, so container types can no longer hide a disallowed element or generic argument from the blocklist mitigation.
- Fixes a deserialization-of-untrusted-data vulnerability (CVE-2026-48517).
SignalR reader skip: The iterative MessagePackReader.TrySkip() described under 2.5.192.2 also covers the ASP.NET Core advisory for the same skip path, which SignalR's MessagePack protocol uses.
- Fixes an uncontrolled-resource-consumption denial-of-service vulnerability (CVE-2026-45591).
Deep nesting (inherited): The 2.5.192.x line forks upstream MessagePack 2.5.192, which already includes the upstream 2.5.187 fix for stack overflows from deeply nested untrusted data, so no backport was needed.
- Covers a stack-overflow denial-of-service vulnerability (CVE-2024-48924).

2.5.192.2 (NES)

Notes

This release keeps NES for MessagePack on the 2.5.192.x line while backporting LZ4 decompression hardening and reader skip depth hardening for three upstream MessagePack security advisories.

Security Fixes

LZ4 decompression: Adds bounds checks for crafted LZ4 payloads that could trigger out-of-bounds reads and an AccessViolationException denial of service when deserializing untrusted data with LZ4 compression enabled.
- This fixes a high-severity MessagePack LZ4 denial-of-service vulnerability (CVE-2026-48109).
LZ4 decompressed-size limit: LZ4 block deserialization now validates each declared uncompressed length against the configured MessagePackSecurity.MaximumDecompressedSize (with a running budget across block-array payloads) before allocating the output buffer, so crafted payloads can no longer request disproportionate allocations ahead of validation.
- Fixes a memory-allocation denial-of-service vulnerability (CVE-2026-48510).
Reader skip depth: MessagePackReader.TrySkip() now skips nested arrays and maps iteratively instead of recursing, so skipping deeply nested untrusted data no longer bypasses the MaximumObjectGraphDepth limit and exhausts the stack.
- Fixes an uncontrolled-recursion denial-of-service vulnerability (CVE-2026-48506).