---
id: CVE-2026-107296
title: msgpack5 is a msgpack v5 implementation for node.js and the browser
summary: >-
  msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to
  6.1.0, decoding a negative signed 64-bit integer modifies the corresponding
  bytes in the caller-provided input buffer while computing the value.
  Applications t…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-471
vendor: msgpack5
product: msgpack5
affected:
  - msgpack5 < 6.1.0
patched:
  - msgpack5 6.1.0
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:48:36.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107296'
references:
  - url: >-
      https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91
    label: security-advisories@github.com
  - url: 'https://github.com/mcollina/msgpack5/releases/tag/v6.1.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qw35-55vc-rhgj'
tags:
  - nvd
  - ghsa
  - npm
  - cve.org
aliases:
  - GHSA-qw35-55vc-rhgj
ecosystem: npm
ingestedAt: '2026-10-08T17:56:11.714Z'
---

## Overview

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-107296)

Affected packages:

- `msgpack5 < 6.1.0`

Patched in:

- `msgpack5 6.1.0`

Source: https://github.com/advisories/GHSA-qw35-55vc-rhgj