CVE-2026-107296: msgpack5: Decoding negative int64 values mutates the input buffer

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-14
Weakness: CWE-471

Description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

Affected products

mcollina msgpack5: before 6.1.0

References

https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj

Get alerted when CVE-2026-107296 or the next vulnerability affects your stack