CVE-2026-107301: msgpack5 Prototype Protection Bypass Vulnerability
Summary
CVE-2026-107301: msgpack5: Partial options disable prototype protection. Affects msgpack5 versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
msgpack5 is a popular npm package used for MessagePack serialization and deserialization in JavaScript applications. It provides a fast and efficient way to encode and decode data, making it suitable for applications that require high performance and low overhead. However, a recent vulnerability has been identified that compromises its prototype protection mechanism, potentially allowing attackers to manipulate object prototypes during the decoding process.
Vulnerability Detail
The vulnerability arises when an empty or partial options object is passed to the msgpack5 instance. This action disables the default prototype protection, specifically the 'protoAction: error' setting. Consequently, if a map containing a 'proto' key is included in the decoded data, it can overwrite the prototype of the decoded object. This manipulation can lead to altered inherited properties and unexpected behavior in the application, posing a security risk. It is important to note that this vulnerability does not affect the global Object.prototype, but it can still have significant implications for the integrity of the affected objects.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, explicitly set the protoAction option to 'error' when creating a msgpack5 instance. Here is an example of how to do this:
const msgpack5 = require('msgpack5')();
const options = { protoAction: 'error' };
const decoded = msgpack5.decode(buffer, options);
Conclusion
The msgpack5 package has a vulnerability (CVE-2026-107301) that compromises its prototype protection when an empty or partial options object is passed. It is crucial to update to version 6.1.0 or later to mitigate this risk. Additionally, implementing the recommended workaround can provide temporary protection until the update is applied.
See every vulnerability recorded for msgpack5 →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability could allow attackers to manipulate object prototypes, leading to potential security breaches and unexpected behavior in your application.
Yes, this vulnerability affects versions of msgpack5 prior to 6.1.0. Updating to this version or later will mitigate the issue.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file. It helps ensure your applications remain secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
