Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

msgpack5 corrupts input when decoding negative integers

CVE-2026-107296 · published 10 days ago
Summary

The msgpack5 library, used for handling MessagePack data in Node.js and browsers, changes the original data buffer when it reads a negative 64‑bit integer. This can cause hidden data corruption for any process that keeps or reuses the original data, such as integrity checks or logging. Upgrade to version 6.1.0 or later to stop the buffer from being altered.

What to do
  • Update msgpack5 to version 6.1.0.
Affected software
Ecosystem VendorProductAffected versions
– mcollina msgpack5 < 6.1.0
npm – msgpack5 < 6.1.0
Fix: upgrade to 6.1.0
Original advisory text
msgpack5: Decoding negative int64 values mutates the input buffer
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-471Modification of Assumed-Immutable Data (MAID)
Timeline
Published8 Oct 2026
Updated15 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-107296 · NVD
CVE-2026-107296 · MITRE
GHSA-qw35-55vc-rhgj · GHSA
CVE-2026-107296 · OSV
GHSA-qw35-55vc-rhgj · OSV
Track software like this
Free during beta