CVEvulnerability

CVE-2026-107296

3.7 LOW Published 2026-10-08 Modified 2026-10-14 Official page ↗
Status
Deferred
Published
2026-10-08
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-471

Description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

Related

Weakness · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References