There are a few issues around CBOR parsing in Solidity:
If new keys are added in future to existing structures this could break contracts
A workaround for this, is passing in a 'schema version' argument, which returns different structures - e.g. request 'version 2' to return the struct with the new fields
Implement a skipping CBOR parser, which skips past unknown keys
This was noted in an audit:
There are a few issues around CBOR parsing in Solidity: