| Package | Affected versions | Patched versions |
|---|---|---|
| msgpack5 | < 6.1.0 | 6.1.0 |
Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.
Only the decoded object's prototype is affected; this does not modify Object.prototype globally.
Options are now merged with secure defaults without modifying the caller's object. Unsupported protoAction values are rejected.
Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free