msgpack5: Many buffered values can exhaust the streaming decoder stack

### Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. ### Patches The streaming decoder now drains concatenated values iteratively with constant call-stack depth. ### Workarounds Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream. Source Code Location: https://github.com/mcollina/msgpack5 Affected Packages: - npm:msgpack5, affected < 6.1.0, patched in 6.1.0 CWEs: - CWE-674: Uncontrolled Recursion CVSS: - Primary: score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS_V3: score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: - https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9 - https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba - https://github.com/mcollina/msgpack5/releases/tag/v6.1.0 - https://github.com/advisories/GHSA-5x5g-h9x8-2fh9