CVE-2026-107301 Details
Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.
A prototype poisoning vulnerability exists in msgpack5, a MessagePack v5 implementation for Node.js and the browser, in versions prior to 6.1.0. The issue arises when msgpack5 is constructed with an empty or partial options object, which disables the default 'error' protection against prototype poisoning. This allows a decoded map containing a __proto__ key to replace the prototype of the decoded object, potentially altering inherited properties or downstream behavior, although it does not globally modify Object.prototype.
Users can upgrade to msgpack5 version 6.1.0 or later, where this vulnerability is fixed. In version 6.1.0, the library merges options with secure defaults, preserving the prototype protection. When using partial options, it is important to explicitly set 'protoAction' to 'error' to maintain the default protection against prototype poisoning.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774 | [email protected] | Source CodeVendor |
| https://github.com/mcollina/msgpack5/releases/tag/v6.1.0 | [email protected] | Release NotesVendor |
| https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcollina msgpack5 | < 6.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |