MessagePack-CSharp · AArnott · Jun 9, 2026 · May 14, 2026 · Apr 29, 2026 · Apr 29, 2026
diff --git a/src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs b/src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs
@@ -9,16 +9,17 @@ namespace MessagePack.AspNetCoreMvcFormatter
     public class MessagePackInputFormatter : InputFormatter
     {
         private const string ContentType = "application/x-msgpack";
-        private readonly MessagePackSerializerOptions? options;
+        private static readonly MessagePackSerializerOptions DefaultOptions = MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData);
+        private readonly MessagePackSerializerOptions options;
 
         public MessagePackInputFormatter()
-            : this(null)
+            : this(DefaultOptions)
         {
         }
 
         public MessagePackInputFormatter(MessagePackSerializerOptions? options)
         {
-            this.options = options;
+            this.options = options ?? DefaultOptions;
 
             SupportedMediaTypes.Add(ContentType);
         }

diff --git a/src/MessagePack.UnityClient/Assets/Scripts/MessagePack/Extension/UnsafeBlitFormatter.cs b/src/MessagePack.UnityClient/Assets/Scripts/MessagePack/Extension/UnsafeBlitFormatter.cs
@@ -55,19 +55,25 @@ public unsafe void Serialize(ref MessagePackWriter writer, T[]? value, MessagePa
                 return null;
             }
 
-            ExtensionHeader header = reader.ReadExtensionFormatHeader();
-            if (header.TypeCode != this.TypeCode)
+            ExtensionResult extension = reader.ReadExtensionFormat();
+            if (extension.TypeCode != this.TypeCode)
             {
                 throw new InvalidOperationException("Invalid typeCode.");
             }
 
-            var byteLength = reader.ReadInt32();
-            var isLittleEndian = reader.ReadBoolean();
+            MessagePackReader extensionReader = reader.Clone(extension.Data);
+            var byteLength = extensionReader.ReadInt32();
+            var isLittleEndian = extensionReader.ReadBoolean();
+            long remainingBytes = extensionReader.Sequence.Length - extensionReader.Consumed;
+            if (byteLength < 0 || byteLength % sizeof(T) != 0 || byteLength != remainingBytes)
+            {
+                throw new MessagePackSerializationException("Invalid Unity blit extension length.");
+            }
 
             // Allocate a T[] that we will return. We'll then cast the T[] as byte[] so we can copy the byte sequence directly into it.
             var result = new T[byteLength / sizeof(T)];
             Span<byte> resultAsBytes = MemoryMarshal.Cast<T, byte>(result);
-            reader.ReadRaw(byteLength).CopyTo(resultAsBytes);
+            extensionReader.ReadRaw(byteLength).CopyTo(resultAsBytes);
 
             // Reverse the byte order if necessary.
             if (isLittleEndian != BitConverter.IsLittleEndian && result.Length > 0)

diff --git a/src/MessagePack/Formatters/CollectionFormatter.cs b/src/MessagePack/Formatters/CollectionFormatter.cs
@@ -928,7 +928,7 @@ protected override ILookup<TKey, TElement> Complete(Dictionary<TKey, IGrouping<T
 
         protected override Dictionary<TKey, IGrouping<TKey, TElement>> Create(int count, MessagePackSerializerOptions options)
         {
-            return new Dictionary<TKey, IGrouping<TKey, TElement>>(count);
+            return new Dictionary<TKey, IGrouping<TKey, TElement>>(count, options.Security.GetEqualityComparer<TKey>());
         }
     }
 

diff --git a/src/MessagePack/Formatters/ExpandoObjectFormatter.cs b/src/MessagePack/Formatters/ExpandoObjectFormatter.cs
@@ -8,6 +8,8 @@ namespace MessagePack.Formatters
 {
     public class ExpandoObjectFormatter : IMessagePackFormatter<ExpandoObject?>
     {
+        internal const int MaximumUntrustedDataMemberCount = 1024;
+
         public static readonly IMessagePackFormatter<ExpandoObject?> Instance = new ExpandoObjectFormatter();
 
         private ExpandoObjectFormatter()
@@ -23,6 +25,7 @@ private ExpandoObjectFormatter()
 
             var result = new ExpandoObject();
             int count = reader.ReadMapHeader();
+            ThrowIfMapTooLargeForUntrustedData(count, options);
             if (count > 0)
             {
                 IFormatterResolver resolver = options.Resolver;
@@ -49,6 +52,14 @@ private ExpandoObjectFormatter()
             return result;
         }
 
+        internal static void ThrowIfMapTooLargeForUntrustedData(int count, MessagePackSerializerOptions options)
+        {
+            if (options.Security.HashCollisionResistant && count > MaximumUntrustedDataMemberCount)
+            {
+                throw new MessagePackSerializationException($"ExpandoObject map size exceeds the limit of {MaximumUntrustedDataMemberCount} entries allowed under untrusted data security mode.");
+            }
+        }
+
         public void Serialize(ref MessagePackWriter writer, ExpandoObject? value, MessagePackSerializerOptions options)
         {
             if (value is null)

diff --git a/src/MessagePack/Formatters/MultiDimensionalArrayFormatter.cs b/src/MessagePack/Formatters/MultiDimensionalArrayFormatter.cs
@@ -2,9 +2,7 @@
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
 using System;
-using System.Buffers;
-using System.Collections.Generic;
-using System.Text;
+using System.Diagnostics.CodeAnalysis;
 using MessagePack.Internal;
 
 #pragma warning disable SA1402 // File may only contain a single type
@@ -64,6 +62,7 @@ public void Serialize(ref MessagePackWriter writer, T[,]? value, MessagePackSeri
                 var iLength = reader.ReadInt32();
                 var jLength = reader.ReadInt32();
                 var maxLen = reader.ReadArrayHeader();
+                MultiDimensionalArrayFormatterHelper.ThrowIfLengthsDontMatch("T[,]", maxLen, iLength, jLength);
 
                 var array = new T[iLength, jLength];
 
@@ -151,6 +150,7 @@ public void Serialize(ref MessagePackWriter writer, T[,,]? value, MessagePackSer
                 var jLength = reader.ReadInt32();
                 var kLength = reader.ReadInt32();
                 var maxLen = reader.ReadArrayHeader();
+                MultiDimensionalArrayFormatterHelper.ThrowIfLengthsDontMatch("T[,,]", maxLen, iLength, jLength, kLength);
 
                 var array = new T[iLength, jLength, kLength];
 
@@ -248,6 +248,8 @@ public void Serialize(ref MessagePackWriter writer, T[,,,]? value, MessagePackSe
                 var kLength = reader.ReadInt32();
                 var lLength = reader.ReadInt32();
                 var maxLen = reader.ReadArrayHeader();
+                MultiDimensionalArrayFormatterHelper.ThrowIfLengthsDontMatch("T[,,,]", maxLen, iLength, jLength, kLength, lLength);
+
                 var array = new T[iLength, jLength, kLength, lLength];
 
                 var i = 0;
@@ -295,4 +297,34 @@ public void Serialize(ref MessagePackWriter writer, T[,,,]? value, MessagePackSe
             }
         }
     }
+
+    internal static class MultiDimensionalArrayFormatterHelper
+    {
+        internal static void ThrowIfLengthsDontMatch(string format, int actualLength, int firstLength, int secondLength, int thirdLength = 1, int fourthLength = 1)
+        {
+            if (firstLength < 0 || secondLength < 0 || thirdLength < 0 || fourthLength < 0)
+            {
+                ThrowInvalidFormat(format);
+            }
+
+            int expectedLength;
+            try
+            {
+                expectedLength = checked(firstLength * secondLength * thirdLength * fourthLength);
+            }
+            catch (OverflowException)
+            {
+                ThrowInvalidFormat(format);
+                return;
+            }
+
+            if (expectedLength != actualLength)
+            {
+                ThrowInvalidFormat(format);
+            }
+        }
+
+        [DoesNotReturn]
+        private static void ThrowInvalidFormat(string format) => throw new MessagePackSerializationException($"Invalid {format} format");
+    }
 }
diff --git a/src/MessagePack/Formatters/StandardClassLibraryFormatter.cs b/src/MessagePack/Formatters/StandardClassLibraryFormatter.cs
@@ -837,9 +837,14 @@ public void Serialize(ref MessagePackWriter writer, T? value, MessagePackSeriali
 
         public T? Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
         {
-            return reader.ReadString() is string value
-                ? (T?)Type.GetType(value, throwOnError: true)
-                : null;
+            if (reader.ReadString() is not string value)
+            {
+                return null;
+            }
+
+            Type type = options.LoadType(value) ?? throw new TypeLoadException(value);
+            options.ThrowIfDeserializingTypeIsDisallowed(type);
+            return (T?)type;
         }
     }
 

diff --git a/src/MessagePack/Internal/TinyJsonReader.cs b/src/MessagePack/Internal/TinyJsonReader.cs
@@ -137,62 +137,64 @@ private static bool IsWordBreak(char c)
 
         private void ReadNextToken()
         {
-            this.SkipWhiteSpace();
-
-            var intChar = this.reader.Peek();
-            if (intChar == -1)
+            while (true)
             {
-                this.TokenType = TinyJsonToken.None;
-                return;
-            }
+                this.SkipWhiteSpace();
 
-            var c = (char)intChar;
-            switch (c)
-            {
-                case '{':
-                    this.TokenType = TinyJsonToken.StartObject;
-                    return;
-                case '}':
-                    this.TokenType = TinyJsonToken.EndObject;
-                    return;
-                case '[':
-                    this.TokenType = TinyJsonToken.StartArray;
-                    return;
-                case ']':
-                    this.TokenType = TinyJsonToken.EndArray;
-                    return;
-                case '"':
-                    this.TokenType = TinyJsonToken.String;
-                    return;
-                case '0':
-                case '1':
-                case '2':
-                case '3':
-                case '4':
-                case '5':
-                case '6':
-                case '7':
-                case '8':
-                case '9':
-                case '-':
-                    this.TokenType = TinyJsonToken.Number;
-                    return;
-                case 't':
-                    this.TokenType = TinyJsonToken.True;
-                    return;
-                case 'f':
-                    this.TokenType = TinyJsonToken.False;
-                    return;
-                case 'n':
-                    this.TokenType = TinyJsonToken.Null;
-                    return;
-                case ',':
-                case ':':
-                    this.reader.Read();
-                    this.ReadNextToken();
+                var intChar = this.reader.Peek();
+                if (intChar == -1)
+                {
+                    this.TokenType = TinyJsonToken.None;
                     return;
-                default:
-                    throw new TinyJsonException("Invalid String:" + c);
+                }
+
+                var c = (char)intChar;
+                switch (c)
+                {
+                    case '{':
+                        this.TokenType = TinyJsonToken.StartObject;
+                        return;
+                    case '}':
+                        this.TokenType = TinyJsonToken.EndObject;
+                        return;
+                    case '[':
+                        this.TokenType = TinyJsonToken.StartArray;
+                        return;
+                    case ']':
+                        this.TokenType = TinyJsonToken.EndArray;
+                        return;
+                    case '"':
+                        this.TokenType = TinyJsonToken.String;
+                        return;
+                    case '0':
+                    case '1':
+                    case '2':
+                    case '3':
+                    case '4':
+                    case '5':
+                    case '6':
+                    case '7':
+                    case '8':
+                    case '9':
+                    case '-':
+                        this.TokenType = TinyJsonToken.Number;
+                        return;
+                    case 't':
+                        this.TokenType = TinyJsonToken.True;
+                        return;
+                    case 'f':
+                        this.TokenType = TinyJsonToken.False;
+                        return;
+                    case 'n':
+                        this.TokenType = TinyJsonToken.Null;
+                        return;
+                    case ',':
+                    case ':':
+                        this.reader.Read();
+                        continue;
+                    default:
+                        throw new TinyJsonException("Invalid String:" + c);
+                }
             }
         }
-Original file line number
+Diff line change
@@ Expand Up @@
             protected override Dictionary<TKey, IGrouping<TKey, TElement>> Create(int count, MessagePackSerializerOptions options)
             {
-                return new Dictionary<TKey, IGrouping<TKey, TElement>>(count);
+                return new Dictionary<TKey, IGrouping<TKey, TElement>>(count, options.Security.GetEqualityComparer<TKey>());
             }
         }
@@ Expand Down @@