Description
Decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer. Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data.
Positive integers and other MessagePack value types are not affected.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.1.0
- Patched version(s): 6.1.0
References
Could your website be exposed too?
SmartScanner can check your website for msgpack5: Decoding negative int64 values mutates the input buffer and gives you actionable findings to investigate.
Start a free scanRelated Issues
- msgpack5: Deeply nested input can exhaust the decoder stack - CVE-2026-107298
- LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash - CVE-2026-33285
- msgpack5: Many buffered values can exhaust the streaming decoder stack - CVE-2026-107300
- decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input - CVE-2026-45822
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2026