GitHub Advisoryadvisory · npm

GHSA-8hq7-ggx2-cc6m msgpack5: Partial options disable prototype protection

MEDIUM Published 2026-10-08 Modified 2026-10-08 Official page ↗
Aliases
CVE-2026-107301
Ecosystem
npm
Packages
msgpack5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-1321
Reviewed
2026-10-08

Affected packages

• npm msgpack5: < 6.1.0 → fixed in 6.1.0

Description

Impact Passing an empty or partial options object disables the default `protoAction: 'error'` protection. A map containing a `__proto__` key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code. Only the decoded object's prototype is affected; this does not modify `Object.prototype` globally. Patches Options are now merged with secure defaults without modifying the caller's object. Unsupported `protoAction` values are rejected. Workarounds Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use.

Related

Alias · CVE (1)

  • CVE-2026-107301 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References