CVE-2026-107296 Details
Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.
A vulnerability exists in msgpack5, a MessagePack v5 implementation for Node.js and the browser, prior to version 6.1.0. When decoding negative signed 64-bit integers, the library unintentionally modifies the original bytes in the input buffer provided by the caller. This mutation can lead to silent data corruption, especially for applications that rely on the integrity of the encoded input for logging, processing, or integrity checks. In contrast, decoding positive integers and other MessagePack value types remains unaffected.
Users can upgrade to msgpack5 version 6.1.0 or later, where this vulnerability has been fixed. Alternatively, untrusted MessagePack input can be copied before decoding, or input buffers can be discarded after decoding to prevent data corruption.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91 | [email protected] | Source CodeVendor |
| https://github.com/mcollina/msgpack5/releases/tag/v6.1.0 | [email protected] | Release NotesVendor |
| https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcollina msgpack5 | < 6.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |