CVE-2026-107296

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.

• CWE-471

• https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91
• https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
• https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107290Pydantic AI is a Python agent framework for building applica…6.5
• CVE-2026-107291Pydantic AI is a Python agent framework for building applica…2.3
• CVE-2026-107292Pydantic AI is a Python agent framework for building applica…6.4
• CVE-2026-107293Pydantic AI is a Python agent framework for building applica…2.3
• CVE-2026-107294Pydantic AI is a Python agent framework for building applica…6.5
• CVE-2026-107295Pydantic AI is a Python agent framework for building applica…7.6
• CVE-2026-107297msgpack5 is a msgpack v5 implementation for node.js and the …5.9
• CVE-2026-107298msgpack5 is a msgpack v5 implementation for node.js and the …5.3
• CVE-2026-107299msgpack5 is a msgpack v5 implementation for node.js and the …5.9
• CVE-2026-1073The Purchase Button For Affiliate Link plugin for WordPress …4.3
• CVE-2026-107300msgpack5 is a msgpack v5 implementation for node.js and the …7.5
• CVE-2026-107301msgpack5 is a msgpack v5 implementation for node.js and the …6.5