CVE-2026-107301: msgpack5 prototype protection bypass when constructed with empty or partial options

What happened

Constructing msgpack5 with an empty or partial options object disables the package's default protoAction: 'error' protection. When that protection is disabled, a decoded MessagePack map that contains a __proto__ key can replace the prototype of the decoded object, potentially changing inherited properties or downstream behavior. The issue does not modify Object.prototype globally. [4128, 31829]

Technical cause

The default protoAction setting (protoAction: 'error') is not enforced if msgpack5 is constructed with an empty or partial options object. That configuration gap permits a decoded map with a __proto__ key to be applied as the decoded object's prototype. The advisory describes this behavior and the resulting prototype replacement. [4128, 31829]

Why it matters

Replacing a decoded object's prototype can change inherited properties or affect downstream code that relies on those properties, which may alter application behavior or logic after decoding untrusted input. The advisory indicates the potential for changed inherited properties or downstream behavior; it also notes Object.prototype is not modified globally. [4128, 31829]

Who is affected

Users of the msgpack5 library (Node.js and browser environments) who construct msgpack5 with an empty or partial options object are affected. Decoding untrusted MessagePack data under those construction conditions is where the described behavior can occur. [4128, 31829]

Discovery and timeline

The advisory entries for this issue were published on 2026-10-08. The OSV.dev entry and NVD record are the public sources referenced for this advisory. The package advisory metadata lists publication and modification timestamps. [4128, 31829]

Affected versions

The advisory claims msgpack5 is affected from version 0 up to (but not including) 6.1.0. [4128]

Fixes and mitigation

A fix is available: the advisory states the issue is fixed in 6.1.0. The advisory does not provide other mitigation steps. [4128, 31829]

Recommended action

Upgrade msgpack5 to 6.1.0. If you cannot upgrade immediately, avoid constructing msgpack5 with an empty or partial options object where feasible and treat MessagePack inputs from untrusted sources as untrusted until the environment is updated. The advisory identifies the construction-with-empty-or-partial-options condition as the trigger for disabled protection. [4128, 31829]