Description
Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.1.0
- Patched version(s): 6.1.0
References
Could your website be exposed too?
SmartScanner can check your website for msgpack5: Partial options disable prototype protection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype Pollution Gadget in axios toFormData Options - CVE-2026-101909
- Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro - CVE-2026-41248
- markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression - CVE-2026-111758
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2026