All vulnerabilities
CVE-2026-107301GHSA-8hq7-ggx2-cc6m

msgpack5: Partial options disable prototype protection

mcollina msgpack5npmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.1.0Fixed versionGitHub
Published8 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 6.1.0msgpack5, npmGitHubnpm install msgpack5@6.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.

Only the decoded object's prototype is affected; this does not modify Object.prototype globally.

Patches

Options are now merged with secure defaults without modifying the caller's object. Unsupported protoAction values are rejected.

Workarounds

Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.

Text from GitHub Advisory Database

Affected versions 3

  • msgpack5, npm< 6.1.0GitHub
  • msgpack5affected: < 6.1.0CVE List
  • msgpack5, npmfrom first release, fixed in 6.1.0OSV

References 4