< Back

CVE-2026-107301

Updated on 08 Oct 2026

Severity

6.5 Medium severity

Details

CVSS score
6.5
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Impact

Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.

Only the decoded object’s prototype is affected; this does not modify Object.prototype globally.

Patches

Options are now merged with secure defaults without modifying the caller’s object. Unsupported protoAction values are rejected.

Workarounds

Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.

Details

Affected product:
loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , msgpack5
Affected packages:
msgpack5 @ 3.6.1 (+10 more)

Fixes