GHSA-8HQ7-GGX2-CC6M msgpack5: Partial options disable prototype protection

Impact Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a proto key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code. Only the decoded...

EUVD-2026-95112

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

CVE-2026-107301

The msgpack5 library, a msgpack v5 implementation for Node.js and browsers, is vulnerable to prototype pollution in versions prior to 6.1.0 . The root cause is that constructing the library with an empty or partial options object disables the default protoAction: 'error' protection. This allows a...

PT-2026-108639

Impact Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a proto key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code. Only the decoded...

PT-2026-108061

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description Constructing the software with an empty or partial options object disables the default protoAction: 'error' protection. This allows a decoded map containing a proto key to replace the prototype of t...