EUVD-2026-95107
GHSA-qw35-55vc-rhgj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply MessagePack input with negative int64
-
ExploitApplication decodes buffer via msgpack5
-
ExecutionDecoder mutates bytes in caller's buffer
-
ImpactReused buffer yields corrupted/mismatched data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires all of: (1) the application uses msgpack5 < 6.1.0; (2) it decodes MessagePack input containing a negative signed 64-bit integer (positive integers and all other MessagePack types are explicitly unaffected); and (3) critically, it retains or reuses the same caller-provided input buffer after decoding - for integrity/hash verification, logging, or later re-processing. Applications that discard the input buffer immediately after decoding, or that copy untrusted input before decoding (the vendor-recommended workaround), are not impacted. There is no code execution, memory disclosure, or crash; impact is limited to silent corruption of the retained buffer's bytes. |
| Impact | This is a genuinely low-severity, low-priority issue despite being network-reachable. The provided CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) correctly captures a limited integrity-only impact: no confidentiality loss, no availability loss, and only Low integrity impact arising from mutation of the caller's input buffer. AC:H is appropriate because exploitation is conditional on the application retaining or reusing the decoded buffer. No EPSS score, no CISA KEV listing, and no public POC were provided, which is consistent with a data-integrity correctness bug rather than a weaponizable flaw - there is no path to code execution, memory corruption, or data exfiltration. The input Tags label this 'Information Disclosure,' but that conflicts with the evidence: CWE-471 (modification of assumed-immutable data), C:N in the CVSS vector, and the GHSA title ('mutates the input buffer') all point to an integrity issue, not disclosure. Net assessment: real but minor - patch during normal maintenance, not as an emergency. |
| Exploit ScenarioDerived | An application decodes attacker-supplied MessagePack data (e.g., a network message or stored record) containing a negative signed 64-bit integer using msgpack5 < 6.1.0, then later reuses that same input buffer to recompute a hash/HMAC, write an audit log, or forward the original bytes. Because decoding silently rewrites the integer's bytes in place, the retained buffer no longer matches the original payload, causing integrity-check mismatches or corrupted downstream data. No public exploit identified at time of analysis; this is a correctness defect triggered by ordinary decoding, not an active attack technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Silent in-place corruption of caller-supplied buffers occurs in the npm package msgpack5 before version 6.1.0 whenever the decoder parses a negative signed 64-bit integer (MessagePack int64, 0xd3): the two's-complement negation is written back into the very bytes of the caller's input buffer. The bug is network-reachable but high-complexity to exploit and low-impact - CVSS 3.1 base score 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, unauthenticated per the PR:N vector) - because it yields no code execution, no memory disclosure and no denial of service; the only consequence is that an application which retains or reuses the same buffer after decoding (for integrity/hash checks, logging, or later re-processing) may see silently altered values. Only negative int64 values are affected; positive integers and all other MessagePack types are untouched, applications that discard or copy the input before decoding are unaffected, and there is no public exploit or CISA KEV record - confirmed active exploitation has not been reported and no POC was identified at time of analysis. Version 6.1.0 contains the vendor fix.
RemediationAI
Upgrade to msgpack5 6.1.0 or later - this is the vendor-released patch, published to npm and tagged at https://github.com/mcollina/msgpack5/releases/tag/v6.1.0, with the code change visible in commit 82b70393a824e1088a45a377548d1d9ab82faf91 and documented in advisory GHSA-qw35-55vc-rhgj. If upgrading is not immediately possible, the vendor-recommended compensating control is to copy untrusted MessagePack input before handing it to the decoder (for example Buffer.from(untrusted)), or to ensure the input buffer is discarded and never retained or reused after decoding - this fully removes the impact but adds a memory and CPU copy cost proportional to message size, which can matter in high-throughput pipelines. A second option is to avoid treating the input buffer as trustworthy after decode: re-serialize or re-acquire the bytes rather than hashing or logging the original buffer, and validate any integrity check against a copy taken before decode; this requires application-level code changes and is easy to miss in existing call paths. There is no configuration flag in msgpack5 that disables the affected int64 code path, so decoding negative int64 values cannot be turned off without rejecting those messages entirely, which would break legitimate MessagePack data - given the low severity (no code execution, no disclosure, no DoS, and no public exploit or CISA KEV evidence of exploitation), this is a low-priority patch to schedule rather than an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
msgpack5 is a JavaScript implementation of the MessagePack v5 binary serialization format for Node.js and the browser, published on npm and also shipped as prebuilt bundles (dist/msgpack5.js and dist/msgpack5.min.js) for browser consumers. The defect is a CWE-471 (Modification of Assumed-Immutable Data) flaw in the decoder's signed-integer path: to convert the raw 8-byte big-endian encoding of a negative int64 into a JavaScript number, the code performed an in-place two's-complement negation loop over the caller's buffer (buf[i] = v & 0xff for i from offset+7 down to offset) before reading it with readUInt32BE. Because the decode API accepts, and traditionally did not copy, the caller-provided Buffer, this loop mutated the input in place - a side effect callers would not expect from a read-only decode operation. The upstream fix (commit 82b70393a824e1088a45a377548d1d9ab82faf91, first released as v6.1.0) removes the write-back entirely, computing the negative value with pure bitwise arithmetic on values read via buf.readUInt32BE(offset) and buf.readUInt32BE(offset + 4) (hi = (~hi + (lo === 0 ? 1 : 0)) >>> 0, lo = (~lo + 1) >>> 0) and passing the buffer plus offset directly to the int64 reader instead of a slice. The same change also tidies the float decode path. No CPE strings were supplied with this record; the affected component is unambiguously the npm package msgpack5 and its distributed browser bundles at versions below 6.1.0.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N since input may arrive over a network with no auth (PR:N); AC:H because impact depends on the app reusing the buffer; integrity-only (I:L), no confidentiality or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.
Blast Radius
ecosystem impact- 294 npm packages depend on msgpack5 (61 direct, 235 indirect)
Ecosystem-wide dependent count for version 6.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB