Skip to main content
cve.nowby Sazabi
← npm
npmPackage

msgpack5

8 known vulnerabilities (2 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 5 medium, 1 low
Weekly downloads
216.4K
Dependents
296
Registry
npm

Advisories 8

  • msgpack5: Truncated map32 headers throw an unexpected error

    Affected: from 4.1.0, fixed in 6.1.0.

  • CVE-2026-107301Medium 6.5

    msgpack5: Partial options disable prototype protection

    Affected: fixed in 6.1.0.

  • msgpack5: Many buffered values can exhaust the streaming decoder stack

    Affected: fixed in 6.1.0.

  • CVE-2026-107299Medium 5.9

    msgpack5: Reserved byte can cause unbounded stream buffering

    Affected: fixed in 6.1.0.

  • CVE-2026-107298Medium 5.3

    msgpack5: Deeply nested input can exhaust the decoder stack

    Affected: fixed in 6.1.0.

  • CVE-2026-107297Medium 5.9

    msgpack5: Quadratic parsing in the streaming decoder

    Affected: fixed in 6.1.0.

  • msgpack5: Decoding negative int64 values mutates the input buffer

    Affected: fixed in 6.1.0.

  • CVE-2021-21368Medium 6.7

    Prototype poisoning

    Affected: fixed in 3.6.1; from 4.0.0, fixed in 4.5.1; from 5.0.0, fixed in 5.2.1.