Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-107302 (GCVE-0-2026-107302)

Vulnerability from nvd – Published: 2026-10-08 17:14 – Updated: 2026-10-08 17:32

Title

msgpack5: Truncated map32 headers throw an unexpected error

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:32 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/15443…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107302",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:32:15.263797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:32:23.572Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:14:19.514Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8f34-f56x-9xph",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Truncated map32 headers throw an unexpected error"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107302",
    "datePublished": "2026-10-08T17:14:19.514Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:32:23.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107301 (GCVE-0-2026-107301)

Vulnerability from nvd – Published: 2026-10-08 17:13 – Updated: 2026-10-08 17:13

Title

msgpack5: Partial options disable prototype protection

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/20e82…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: \u0027error\u0027 protection. A decoded map containing a __proto__ key can then replace the decoded object\u0027s prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:13:00.613Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8hq7-ggx2-cc6m",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Partial options disable prototype protection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107301",
    "datePublished": "2026-10-08T17:13:00.613Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:13:00.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107300 (GCVE-0-2026-107300)

Vulnerability from nvd – Published: 2026-10-08 17:11 – Updated: 2026-10-08 17:52

Title

msgpack5: Many buffered values can exhaust the streaming decoder stack

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:52 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/77fbe…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:52:32.790652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:52:48.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:11:13.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5x5g-h9x8-2fh9",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Many buffered values can exhaust the streaming decoder stack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107300",
    "datePublished": "2026-10-08T17:11:13.552Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:52:48.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107299 (GCVE-0-2026-107299)

Vulnerability from nvd – Published: 2026-10-08 17:09 – Updated: 2026-10-08 17:09

Title

msgpack5: Reserved byte can cause unbounded stream buffering

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-228 - Improper Handling of Syntactically Invalid Structure

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/85da3…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-228",
              "description": "CWE-228: Improper Handling of Syntactically Invalid Structure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:09:47.191Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-26wq-p25c-j6fv",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Reserved byte can cause unbounded stream buffering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107299",
    "datePublished": "2026-10-08T17:09:47.191Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:09:47.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107298 (GCVE-0-2026-107298)

Vulnerability from nvd – Published: 2026-10-08 17:08 – Updated: 2026-10-09 11:39

Title

msgpack5: Deeply nested input can exhaust the decoder stack

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 11:39 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/1e2b5…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T11:39:21.902387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T11:39:42.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:08:22.022Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-24ch-f2g6-9hhh",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Deeply nested input can exhaust the decoder stack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107298",
    "datePublished": "2026-10-08T17:08:22.022Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-09T11:39:42.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107297 (GCVE-0-2026-107297)

Vulnerability from nvd – Published: 2026-10-08 17:07 – Updated: 2026-10-08 17:26

Title

msgpack5: Quadratic parsing in the streaming decoder

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:26 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/e4827…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:26:19.427864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:26:27.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:07:03.740Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gcx5-hxj7-gpqq",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Quadratic parsing in the streaming decoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107297",
    "datePublished": "2026-10-08T17:07:03.740Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:26:27.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107296 (GCVE-0-2026-107296)

Vulnerability from nvd – Published: 2026-10-08 17:05 – Updated: 2026-10-08 17:05

Title

msgpack5: Decoding negative int64 values mutates the input buffer

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-471 - Modification of Assumed-Immutable Data (MAID)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/82b70…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-471",
              "description": "CWE-471: Modification of Assumed-Immutable Data (MAID)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:05:34.059Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qw35-55vc-rhgj",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Decoding negative int64 values mutates the input buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107296",
    "datePublished": "2026-10-08T17:05:34.059Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:05:34.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-21368 (GCVE-0-2021-21368)

Vulnerability from nvd – Published: 2021-03-12 17:00 – Updated: 2024-08-03 18:09

Title

Prototype poisoning

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver's prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object's prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__'s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This "prototype poisoning" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value's prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer's code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://www.npmjs.com/package/msgpack5	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/commit/d4e6c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 3.6.1 Affected: >= 4.0.0, < 4.5.1 Affected: >= 5.0.0, < 5.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.npmjs.com/package/msgpack5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a \"Prototype Poisoning\" vulnerability. When msgpack5 decodes a map containing a key \"__proto__\", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver\u0027s prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object\u0027s prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__\u0027s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This \"prototype poisoning\" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value\u0027s prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer\u0027s code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-12T17:00:18.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.npmjs.com/package/msgpack5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
        }
      ],
      "source": {
        "advisory": "GHSA-gmjw-49p4-pcfm",
        "discovery": "UNKNOWN"
      },
      "title": "Prototype poisoning",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21368",
          "STATE": "PUBLIC",
          "TITLE": "Prototype poisoning"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "msgpack5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.6.1"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.5.1"
                          },
                          {
                            "version_value": "\u003e= 5.0.0, \u003c 5.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mcollina"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a \"Prototype Poisoning\" vulnerability. When msgpack5 decodes a map containing a key \"__proto__\", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver\u0027s prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object\u0027s prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__\u0027s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This \"prototype poisoning\" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value\u0027s prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer\u0027s code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm",
              "refsource": "CONFIRM",
              "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
            },
            {
              "name": "https://www.npmjs.com/package/msgpack5",
              "refsource": "MISC",
              "url": "https://www.npmjs.com/package/msgpack5"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-gmjw-49p4-pcfm",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21368",
    "datePublished": "2021-03-12T17:00:19.000Z",
    "dateReserved": "2020-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:09:15.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-107302 (GCVE-0-2026-107302)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:14 – Updated: 2026-10-08 17:32

Title

msgpack5: Truncated map32 headers throw an unexpected error

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:32 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/15443…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107302",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:32:15.263797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:32:23.572Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:14:19.514Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8f34-f56x-9xph",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Truncated map32 headers throw an unexpected error"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107302",
    "datePublished": "2026-10-08T17:14:19.514Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:32:23.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107301 (GCVE-0-2026-107301)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:13 – Updated: 2026-10-08 17:13

Title

msgpack5: Partial options disable prototype protection

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/20e82…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: \u0027error\u0027 protection. A decoded map containing a __proto__ key can then replace the decoded object\u0027s prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:13:00.613Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8hq7-ggx2-cc6m",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Partial options disable prototype protection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107301",
    "datePublished": "2026-10-08T17:13:00.613Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:13:00.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107300 (GCVE-0-2026-107300)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:11 – Updated: 2026-10-08 17:52

Title

msgpack5: Many buffered values can exhaust the streaming decoder stack

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:52 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/77fbe…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:52:32.790652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:52:48.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:11:13.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5x5g-h9x8-2fh9",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Many buffered values can exhaust the streaming decoder stack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107300",
    "datePublished": "2026-10-08T17:11:13.552Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:52:48.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107299 (GCVE-0-2026-107299)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:09 – Updated: 2026-10-08 17:09

Title

msgpack5: Reserved byte can cause unbounded stream buffering

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-228 - Improper Handling of Syntactically Invalid Structure

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/85da3…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-228",
              "description": "CWE-228: Improper Handling of Syntactically Invalid Structure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:09:47.191Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-26wq-p25c-j6fv",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Reserved byte can cause unbounded stream buffering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107299",
    "datePublished": "2026-10-08T17:09:47.191Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:09:47.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107298 (GCVE-0-2026-107298)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:08 – Updated: 2026-10-09 11:39

Title

msgpack5: Deeply nested input can exhaust the decoder stack

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 11:39 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/1e2b5…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T11:39:21.902387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T11:39:42.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:08:22.022Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-24ch-f2g6-9hhh",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Deeply nested input can exhaust the decoder stack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107298",
    "datePublished": "2026-10-08T17:08:22.022Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-09T11:39:42.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107297 (GCVE-0-2026-107297)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:07 – Updated: 2026-10-08 17:26

Title

msgpack5: Quadratic parsing in the streaming decoder

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:26 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/e4827…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:26:19.427864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:26:27.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:07:03.740Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gcx5-hxj7-gpqq",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Quadratic parsing in the streaming decoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107297",
    "datePublished": "2026-10-08T17:07:03.740Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:26:27.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107296 (GCVE-0-2026-107296)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:05 – Updated: 2026-10-08 17:05

Title

msgpack5: Decoding negative int64 values mutates the input buffer

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-471 - Modification of Assumed-Immutable Data (MAID)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://github.com/mcollina/msgpack5/commit/82b70…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-471",
              "description": "CWE-471: Modification of Assumed-Immutable Data (MAID)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:05:34.059Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91"
        },
        {
          "name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qw35-55vc-rhgj",
        "discovery": "UNKNOWN"
      },
      "title": "msgpack5: Decoding negative int64 values mutates the input buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107296",
    "datePublished": "2026-10-08T17:05:34.059Z",
    "dateReserved": "2026-10-07T15:53:23.587Z",
    "dateUpdated": "2026-10-08T17:05:34.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-21368 (GCVE-0-2021-21368)

Vulnerability from cvelistv5 – Published: 2021-03-12 17:00 – Updated: 2024-08-03 18:09

Title

Prototype poisoning

Summary

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver's prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object's prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__'s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This "prototype poisoning" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value's prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer's code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mcollina/msgpack5/security/adv…	x_refsource_CONFIRM
https://www.npmjs.com/package/msgpack5	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/releases/tag…	x_refsource_MISC
https://github.com/mcollina/msgpack5/commit/d4e6c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mcollina	msgpack5	Affected: < 3.6.1 Affected: >= 4.0.0, < 4.5.1 Affected: >= 5.0.0, < 5.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.npmjs.com/package/msgpack5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgpack5",
          "vendor": "mcollina",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a \"Prototype Poisoning\" vulnerability. When msgpack5 decodes a map containing a key \"__proto__\", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver\u0027s prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object\u0027s prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__\u0027s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This \"prototype poisoning\" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value\u0027s prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer\u0027s code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-12T17:00:18.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.npmjs.com/package/msgpack5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
        }
      ],
      "source": {
        "advisory": "GHSA-gmjw-49p4-pcfm",
        "discovery": "UNKNOWN"
      },
      "title": "Prototype poisoning",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21368",
          "STATE": "PUBLIC",
          "TITLE": "Prototype poisoning"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "msgpack5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.6.1"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.5.1"
                          },
                          {
                            "version_value": "\u003e= 5.0.0, \u003c 5.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mcollina"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a \"Prototype Poisoning\" vulnerability. When msgpack5 decodes a map containing a key \"__proto__\", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver\u0027s prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object\u0027s prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__\u0027s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This \"prototype poisoning\" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value\u0027s prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer\u0027s code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm",
              "refsource": "CONFIRM",
              "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm"
            },
            {
              "name": "https://www.npmjs.com/package/msgpack5",
              "refsource": "MISC",
              "url": "https://www.npmjs.com/package/msgpack5"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v3.6.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v4.5.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/releases/tag/v5.2.1"
            },
            {
              "name": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8",
              "refsource": "MISC",
              "url": "https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-gmjw-49p4-pcfm",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21368",
    "datePublished": "2021-03-12T17:00:19.000Z",
    "dateReserved": "2020-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:09:15.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities found for msgpack5 by mcollina

CVE-2026-107302 (GCVE-0-2026-107302)

CVE-2026-107301 (GCVE-0-2026-107301)

CVE-2026-107300 (GCVE-0-2026-107300)

CVE-2026-107299 (GCVE-0-2026-107299)

CVE-2026-107298 (GCVE-0-2026-107298)

CVE-2026-107297 (GCVE-0-2026-107297)

CVE-2026-107296 (GCVE-0-2026-107296)

CVE-2021-21368 (GCVE-0-2021-21368)

CVE-2026-107302 (GCVE-0-2026-107302)

CVE-2026-107301 (GCVE-0-2026-107301)

CVE-2026-107300 (GCVE-0-2026-107300)

CVE-2026-107299 (GCVE-0-2026-107299)

CVE-2026-107298 (GCVE-0-2026-107298)

CVE-2026-107297 (GCVE-0-2026-107297)

CVE-2026-107296 (GCVE-0-2026-107296)

CVE-2021-21368 (GCVE-0-2021-21368)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

16 vulnerabilities found for msgpack5 by mcollina

CVE-2026-107302 (GCVE-0-2026-107302)

CVE-2026-107301 (GCVE-0-2026-107301)

CVE-2026-107300 (GCVE-0-2026-107300)

CVE-2026-107299 (GCVE-0-2026-107299)

CVE-2026-107298 (GCVE-0-2026-107298)

CVE-2026-107297 (GCVE-0-2026-107297)

CVE-2026-107296 (GCVE-0-2026-107296)

CVE-2021-21368 (GCVE-0-2021-21368)

CVE-2026-107302 (GCVE-0-2026-107302)

CVE-2026-107301 (GCVE-0-2026-107301)

CVE-2026-107300 (GCVE-0-2026-107300)

CVE-2026-107299 (GCVE-0-2026-107299)

CVE-2026-107298 (GCVE-0-2026-107298)

CVE-2026-107297 (GCVE-0-2026-107297)

CVE-2026-107296 (GCVE-0-2026-107296)

CVE-2021-21368 (GCVE-0-2021-21368)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.