EUVD-2026-95112

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

CVE-2026-107301

The msgpack5 library, a msgpack v5 implementation for Node.js and browsers, is vulnerable to prototype pollution in versions prior to 6.1.0 . The root cause is that constructing the library with an empty or partial options object disables the default protoAction: 'error' protection. This allows a...