CVE-2026-107301

Status: DeferredMedium (6.5)—

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Base score: 6.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.37%
Percentile among all scored CVEs: 29
Score date: 10/13/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access65 %
Primary impactT1565 Data Manipulationimpact75 %
Secondary impactT1059 Command and Scripting Interpreterexecution45 %

Acceso remoto sin autenticación (AV:N, PR:N) a aplicación web msgpack5. Prototype pollution permite manipular propiedades heredadas; impacto primario en integridad de datos (I:H), secundario en ejecución potencial según contexto.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Network Segmentation Vulnerability Scanning Restrict Web-Based Content Restrict File and Directory Permissions Remote Data Storage

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Msgpack5 — Msgpack5^AI

CWEs

CWE-1321

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-107301",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107301",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T01:02:40.915617Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mcollina",
          "product": "msgpack5",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T17:17:16.143",
  "references": [
    {
      "url": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0."
    }
  ],
  "lastModified": "2026-10-14T01:17:05.583",
  "sourceIdentifier": "security-advisories@github.com"
}