CVE-2026-107301: msgpack5: Partial options disable prototype protection

October 8, 2026

Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.

Only the decoded object’s prototype is affected; this does not modify Object.prototype globally.

References

github.com/advisories/GHSA-8hq7-ggx2-cc6m
github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774
github.com/mcollina/msgpack5/releases/tag/v6.1.0
github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m
nvd.nist.gov/vuln/detail/CVE-2026-107301

Code Behaviors & Features

Detect and mitigate CVE-2026-107301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →