{"id":"EUVD-2026-95112","enisaUuid":"91af6a39-6f2b-3c72-9596-e03eebba76c5","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: \u0027error\u0027 protection. A decoded map containing a __proto__ key can then replace the decoded object\u0027s prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:13:00 PM","dateUpdated":"Oct 14, 2026, 1:02:53 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m\nhttps://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","aliases":"CVE-2026-107301\nGHSA-8hq7-ggx2-cc6m\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"ccf03c1d-7bf2-3608-977d-236d55bfa8a3","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"enisaIdVendor":[{"id":"6d2ca6d8-e021-3bce-b530-9b756e63aa26","vendor":{"name":"mcollina"}}],"enisaIdVulnerability":[{"id":"24eb635d-e1a5-3f86-b6c4-41ec37e02e84","vulnerability":{"id":"GHSA-8hq7-ggx2-cc6m","description":"msgpack5: Partial options disable prototype protection","datePublished":"Oct 8, 2026, 5:39:57 PM","dateUpdated":"Oct 8, 2026, 5:39:57 PM","baseScore":0.0,"references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m\nhttps://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774\nhttps://github.com/mcollina/msgpack5\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95112\n","aliases":"GHSA-8hq7-ggx2-cc6m\nCVE-2026-107301\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4892afc9-c0cd-3754-b84f-59e96dcb0721","vulnerability":{"id":"CVE-2026-107301","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: \u0027error\u0027 protection. A decoded map containing a __proto__ key can then replace the decoded object\u0027s prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.","datePublished":"Oct 8, 2026, 5:13:00 PM","dateUpdated":"Oct 14, 2026, 1:02:53 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m\nhttps://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774\nhttps://github.com/mcollina/msgpack5/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-95112\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Oct 27, 2026, 7:17:00 AM","vulnerabilityProduct":[{"id":"93314d87-5c4a-38af-a864-c50d1b4343e3","product":{"name":"msgpack5","vendor":{"name":"mcollina"}},"product_version":"\u003c 6.1.0"}],"vulnerabilityVendor":[{"id":"b8ea7371-5425-3bb3-ad6e-edb7aabdde39","vendor":{"name":"mcollina"}}]}}],"enisaIdAdvisory":[{"id":"660f4a96-cee9-3854-be47-5b9379947c3c","advisory":{"id":"msrc_CVE-2026-107301","description":"msgpack5: Partial options disable prototype protection","datePublished":"Oct 10, 2026, 1:04:56 AM","dateUpdated":"Oct 16, 2026, 1:45:45 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-107301.json\n","aliases":"CVE-2026-107301\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"6fa1fa70-dcd2-372c-9e60-4bb69f5f19c5","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"94a55c13-b487-343a-b1a8-d9ab44521994","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"9accdcca-d083-3d48-ba72-fa09f17d84cf","product":{"name":"azl3 msgpack 0:3.3.0-1.azl3","vendor":{"name":"Microsoft"}}}]}}]}