Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107301 · GHSA-8hq7-ggx2-cc6m

msgpack5: Partial options disable prototype protection

Risk score
50/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherit…
Affected
msgpack5 (npm) < 6.1.0
Fix
Upgrade msgpack5 to 6.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: msgpack5THE FLAWSTHE FIXCVE-2026-107301Partial options disableprototype protectionCVSS 6.5 · EPSS 0%CVE-2026-107302Truncated map32 headersthrow an unexpected errorCVSS 7.5 · EPSS 0%CVE-2026-107300Many buffered values canexhaust the streaming decoderstackCVSS 7.5 · EPSS 0%CVE-2026-107299Reserved byte can causeunbounded stream bufferingCVSS 5.9 · EPSS 0%Upgrade msgpack56.1.0or later on your release lineWho is exposedmsgpack5 (npm) >= 4.1.0, < 6.1.0AMBER · PATCH THIS WEEKmsgpack5msgpack5 is a msgpack v5implementation for node.js andthe browser. Prior to 6.1.0, thedecoder reads the four-bytelength of a map32 value beforevalidating that the completefive-byte header is available. A…Where it standsNo known exploitationCONNECTS TOSame weaknessPrototype pollution (CWE-1321)40 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

msgpack5: Amber, patch this week. msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of …

The flaws

  • CVE-2026-107301: Partial options disable prototype protection (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107302: Truncated map32 headers throw an unexpected error (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107300: Many buffered values can exhaust the streaming decoder stack (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107299: Reserved byte can cause unbounded stream buffering (CVSS 5.9 · EPSS 0%)

The fix

Upgrade msgpack5: 6.1.0 or later on your release line

Who is exposed: msgpack5 (npm) >= 4.1.0, < 6.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
msgpack5npm< 6.1.06.1.0

References

Original description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.