Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| mcollina | msgpack5 | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-qw35-55vc-rhgj | msgpack5: Decoding negative int64 values mutates the input buffer |
Thu, 08 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0. | |
| Title | msgpack5: Decoding negative int64 values mutates the input buffer | |
| Weaknesses | CWE-471 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-10-08T17:05:34.059Z
Reserved: 2026-10-07T15:53:23.587Z
Link: CVE-2026-107296
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-08T17:17:15.390
Modified: 2026-10-08T17:17:15.390
Link: CVE-2026-107296
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-08T18:45:17Z
-
CWE-471
Modification of Assumed-Immutable Data (MAID)