CVE-2021-21368: Prototype Poisoning in msgpack5
Summary
CVE-2021-21368: Prototype poisoning. Affects msgpack5 across 3 version ranges.
< 3.6.1
>= 4.0.0, < 4.5.1
>= 5.0.0, < 5.2.1
Fixed in 3.6.1, 4.5.1 or 5.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
msgpack5 is an npm package that provides a MessagePack implementation for JavaScript. MessagePack is a binary serialization format that is more compact and faster to encode/decode than JSON. msgpack5 allows users to encode and decode data using the MessagePack format. However, a vulnerability has been discovered in msgpack5 that allows for prototype poisoning.
Vulnerability Detail
The vulnerability, known as prototype poisoning, occurs when msgpack5 decodes a map containing a key named "proto". The decoded value is assigned to the __proto__ property, which is an accessor property for the receiver's prototype. If the decoded value is an object or null, msgpack5 sets the decoded object's prototype to that value. This can lead to unexpected behavior, such as values appearing to be of other types, unexpected prototype properties and methods, and potential exceptions when used. However, it is important to note that this vulnerability does not affect the global prototype.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install msgpack5@6.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.6.13.6.1npm install msgpack5@3.6.1 -
>= 4.0.0, < 4.5.14.5.1npm install msgpack5@4.5.1 -
>= 5.0.0, < 5.2.15.2.1npm install msgpack5@5.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users should always validate incoming data after parsing before performing any processing. This can help mitigate the risk of prototype poisoning attacks.
Conclusion
The prototype poisoning vulnerability in msgpack5 can lead to unexpected behavior and potential security risks. It is important for users to update to the patched versions of msgpack5 and validate incoming data to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for msgpack5 →
FAQ
Prototype poisoning is a vulnerability that occurs when an attacker manipulates the prototype of an object to achieve unexpected behavior or gain unauthorized access.
The consequences of prototype poisoning in msgpack5 include values appearing to be of other types, unexpected prototype properties and methods, and potential exceptions when used.
Versions 0.0.0 to 3.6.0, 4.0.0 to 4.5.0, and 5.0.0 to 5.2.0 of msgpack5 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
No, there is currently no known way to escalate this vulnerability to true prototype pollution. The impact is limited to the decoded value's prototype and cannot affect the global prototype.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack5.
