« Back to list

CVE-2026-107296

Status: DeferredLow (3.7)—

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N permite acceso remoto sin privilegios (T1190). La vulnerabilidad corrompe silenciosamente datos en el buffer durante decodificación msgpack, afectando integridad de datos (CWE-471: modificación de datos durante procesamiento). Confianza moderada: explotación requiere AC:H y aplicaciones específ

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork SegmentationLimit Access to Resource Over Network

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Msgpack5 — Msgpack5AI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-107296",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107296",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T01:01:46.974219Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mcollina",
          "product": "msgpack5",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T17:17:15.390",
  "references": [
    {
      "url": "https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-471"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0."
    }
  ],
  "lastModified": "2026-10-14T01:17:05.483",
  "sourceIdentifier": "security-advisories@github.com"
}