pub const MAX_DECODE_DEPTH: usize = 100;Expand description
Maximum MessagePack nesting depth accepted from an untrusted payload.
Every cache read decodes bytes the backend controls, and rmp-serde
recurses once per nesting level, so the failure mode of unbounded depth is
a stack overflow — an uncatchable process abort. rmp-serde’s own
default (1024) is not a safe bound: measured (rmp-serde 1.3.1, 2026-09) on
a 2 MiB thread stack — the tokio worker default — a debug build overflows
between 512 and 768 nested arrays, i.e. a ~700-byte forged entry; a release
build fits 1024 with little margin, and frame size grows with the target
type. 100 matches cachekit-ts (DEFAULT_MAX_DEPTH), leaves a wide margin on
every profile and target (wasm32 included), and sits inside the protocol’s
required 32..=1024 window (spec/interop-mode.md → Decode bounds).
Enforced by cachekit-core’s msgpack_document_len, which runs before
every decode in deserialize and crate::interop::deserialize. Depth
counts every array and map header on the deepest path, empty ones included;
scalars, str, bin and ext are leaves.
Exactly MAX_DECODE_DEPTH levels are accepted, and one more is rejected
with a decode bound: error before rmp-serde recurses.