Is CVE-2026-107301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107301 being exploited in the wild.

How severe is CVE-2026-107301?

Medium severity, with a CVSS score of 6.5, published 8 October 2026.

Which products and versions are affected?

Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

How is CVE-2026-107301 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107301?

Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107301: msgpack5 prototype pollution via partial options

Q: Which products and versions are affected?

Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

Q: Is there a fix for CVE-2026-107301?

Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107301 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107301?

Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107301 · Severity: medium · CVSS 6.5 · Published 2026-10-08

msgpack5 is a JavaScript library that decodes binary data in the MessagePack format. When an application passes an empty or partial options object to msgpack5, the library's default prototype pollution protection is disabled, allowing an attacker to inject malicious code through a crafted `__proto__` key that modifies decoded object prototypes. This can lead to unexpected behavior or application crashes in code that processes untrusted msgpack data.

Technologies: Mcollina Msgpack5, msgpack5 (npm). Vendors: Mcollina, npm.

Quick answers

Is CVE-2026-107301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107301 being exploited in the wild.
How severe is CVE-2026-107301?: Medium severity, with a CVSS score of 6.5, published 8 October 2026.
Which products and versions are affected?: Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.
Is there a fix for CVE-2026-107301?: Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107301 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107301?: Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

msgpack5 (npm): upgrade to 6.1.0 or later
```
npm install msgpack5@6.1.0
```

Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in msgpack5's options handling: when an options object without an explicit `protoAction` property is passed to the constructor, the library fails to merge with secure defaults, leaving the decoded object vulnerable to `__proto__` key injection. An attacker can craft a msgpack message containing a `__proto__` map entry to pollute the prototype of objects decoded without proper protection. The attack requires the application to process untrusted msgpack input and occurs during deserialization on the network attack surface.

Affected products

mcollina msgpack5 < 6.1.0

Identifiers

CVE-2026-107301
GHSA-8hq7-ggx2-cc6m

Timeline

2026-09-26: disclosed
2026-09-26: patched: version 6.1.0 released
2026-10-08: advisory

References

https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.