# CVE-2026-107301: msgpack5 prototype pollution via partial options

Source: https://junglewise.ai/threats/cve-2026-107301-msgpack5-partial-options-disable-prototype-protection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107301 · Severity: medium · CVSS 6.5 · Published 2026-10-08

msgpack5 is a JavaScript library that decodes binary data in the MessagePack format. When an application passes an empty or partial options object to msgpack5, the library's default prototype pollution protection is disabled, allowing an attacker to inject malicious code through a crafted `__proto__` key that modifies decoded object prototypes. This can lead to unexpected behavior or application crashes in code that processes untrusted msgpack data.

Technologies: [Mcollina Msgpack5](https://junglewise.ai/threats/technologies/mcollina-msgpack5), [msgpack5 (npm)](https://junglewise.ai/threats/technologies/msgpack5). Vendors: [Mcollina](https://junglewise.ai/threats/vendors/mcollina), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107301 being exploited in the wild.

**How severe is CVE-2026-107301?** Medium severity, with a CVSS score of 6.5, published 8 October 2026.

**Which products and versions are affected?** Mcollina Msgpack5 < 6.1.0; msgpack5 (npm) < 6.1.0, SEMVER:introduced=0,fixed=6.1.0.

**Is there a fix for CVE-2026-107301?** Yes. msgpack5 (npm): upgrade to 6.1.0 or later. Until then: Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107301 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107301?** Check whether you run Mcollina Msgpack5 or msgpack5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- msgpack5 (npm): upgrade to 6.1.0 or later

  ```sh
  npm install msgpack5@6.1.0
  ```


Explicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use.

## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in msgpack5's options handling: when an options object without an explicit `protoAction` property is passed to the constructor, the library fails to merge with secure defaults, leaving the decoded object vulnerable to `__proto__` key injection. An attacker can craft a msgpack message containing a `__proto__` map entry to pollute the prototype of objects decoded without proper protection. The attack requires the application to process untrusted msgpack input and occurs during deserialization on the network attack surface.

## Affected products

- mcollina msgpack5 < 6.1.0

## Identifiers

- CVE-2026-107301
- GHSA-8hq7-ggx2-cc6m

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: version 6.1.0 released
- 2026-10-08: advisory

## References

- [https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m](https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m)

## Related threats

- [msgpack5 out-of-bounds read in truncated map32 header](https://junglewise.ai/threats/cve-2026-107302-msgpack5-truncated-map32-headers-throw-an-unexpected-error)
- [msgpack5 uncontrolled recursion in streaming decoder](https://junglewise.ai/threats/cve-2026-107300-msgpack5-many-buffered-values-can-exhaust-the-streaming-decoder)
- [msgpack5 unbounded stream buffering via reserved byte](https://junglewise.ai/threats/cve-2026-107299-msgpack5-reserved-byte-can-cause-unbounded-stream-buffering)
- [msgpack5 uncontrolled recursion in decoder](https://junglewise.ai/threats/cve-2026-107298-msgpack5-deeply-nested-input-can-exhaust-the-decoder-stack)
- [msgpack5 quadratic parsing in streaming decoder](https://junglewise.ai/threats/cve-2026-107297-msgpack5-quadratic-parsing-in-the-streaming-decoder)