PT-2026-108057

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk of data arrives. A remote peer can exploit this by splitting a single valid MessagePack container...

PT-2026-108061

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description Constructing the software with an empty or partial options object disables the default protoAction: 'error' protection. This allows a decoded map containing a proto key to replace the prototype of t...

PT-2026-108639

Impact Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a proto key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code. Only the decoded...

PT-2026-108616

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...

PT-2026-108058

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The array and map decoding paths lack a nesting-depth limit. An attacker providing MessagePack input can submit deeply nested containers to exhaust the JavaScript call stack, which interrupts the...

CVE-2026-107299: Improper Handling of Syntactically Invalid Structure

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

CVE-2026-107297: Inefficient Algorithmic Complexity

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107301: Improperly Controlled Modification of Object Prototype Attributes

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

CVE-2026-107298: Uncontrolled Recursion

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a...

CVE-2026-107300: Uncontrolled Recursion

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...

CVE-2026-107296: Modification of Assumed-Immutable Data (MAID)

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks,...

CVE-2026-107302: Out-of-bounds Read

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...

PT-2026-108099

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header causes a checked out-of-bounds buffer read and...

EUVD-2021-0658

Malware in sbrugna...

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

Security Bulletin: A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2021-21366 DESCRIPTION: Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by improper preserve of system...

Security Bulletin: A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-21366 DESCRIPTION: Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by improper...

Prototype Pollution

msgpack5 is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Poisoning

Overview Impact When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. As you are no doubt aware, Object.prototype.proto is an accessor property for the receiver's prototype. If the value corresponding to the key proto decodes to an object or null, msgpack5...

hemera-msgpack (>=1.0.1, <=1.0.9), hexadb (>=0.8.0, <=0.8.2) +9 more potentially affected by CVE-2021-21368 via msgpack5 (>=3.1.0, <=3.5.1)

msgpack5 NPM version =3.1.0, =1.0.1, =0.8.0, =0.0.3, =0.6.2, =0.1.0, =0.1.0, =1.0.0, =0.2.0, =1.0.0, =1.2.0 Source cves: CVE-2021-21368 Source advisory: OSV:GHSA-GMJW-49P4-PCFM...