MessagePack 3.1.9 and 2.5.303 Fix a 32 KiB Payload That Allocates 120 MiB
CVE-2026-92707: nested MessagePack array headers could reuse the same trailing bytes to pass the length check, so deserializing into object allocated thousands of times the payload size. The fix, a before/after probe, and why SignalR apps on .NET 8 through 11 RC 1 need a direct package pin.