CVE-2026-107296

3.7 Faible

Publiée le 08/10/2026 à 19:17 · Modifiée le 14/10/2026 à 03:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

Traduire en français

Produits concernés

mcollina msgpack5

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.7 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-471

Références

https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories