AIKIDO-2026-11178
MessagePack.AspNetCoreMvcFormatter is vulnerable to Initialization of a Resource with an Insecure Default
63
Medium Risk
This Affects:
MessagePack.AspNetCoreMvcFormatterTL;DR
The parameterless MessagePackInputFormatter constructor defaults to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData even though it binds HTTP request bodies. Untrusted clients can therefore deserialize request models without the hash-collision and depth mitigations intended for untrusted data. The fix defaults the parameterless constructor to MessagePackSecurity.UntrustedData.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and register the parameterless MessagePackInputFormatter without explicit untrusted-data serializer options.
Background info
MessagePack.AspNetCoreMvcFormatter is vulnerable to Initialization of a Resource with an Insecure Default in versions 0.0.1 - 2.5.300 and 3.0.0 - 3.1.6.
How to fix this
Upgrade the MessagePack.AspNetCoreMvcFormatter library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant