{"id":1265188,"name":"msgpack5","ecosystem":"npm","description":"A msgpack v5 implementation for node.js and the browser, with extension points","homepage":"https://github.com/mcollina/msgpack5","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/mcollina/msgpack5","keywords_array":["msgpack","extension","v5","MessagePack","ext"],"namespace":null,"versions_count":52,"first_release_published_at":"2014-07-21T10:46:48.546Z","latest_release_published_at":"2026-09-26T10:56:08.309Z","latest_release_number":"6.1.0","last_synced_at":"2026-10-14T22:20:53.348Z","created_at":"2022-04-08T15:21:39.666Z","updated_at":"2026-10-15T12:25:22.500Z","registry_url":"https://www.npmjs.com/package/msgpack5","install_command":"npm install msgpack5","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"6.1.0"},"contentPolicy":null},"repo_metadata":{"id":18722049,"uuid":"21933168","full_name":"mcollina/msgpack5","owner":"mcollina","description":"A msgpack v5 implementation for node.js, with extension points / msgpack.org[Node]","archived":false,"fork":false,"pushed_at":"2026-09-26T12:23:28.000Z","size":871,"stargazers_count":503,"open_issues_count":16,"forks_count":78,"subscribers_count":16,"default_branch":"master","last_synced_at":"2026-10-14T08:56:46.595Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mcollina.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["mcollina"]}},"created_at":"2014-07-17T07:46:48.000Z","updated_at":"2026-10-09T09:16:40.000Z","dependencies_parsed_at":"2026-10-06T08:43:08.222Z","dependency_job_id":null,"html_url":"https://github.com/mcollina/msgpack5","commit_stats":{"total_commits":199,"total_committers":34,"mean_commits":5.852941176470588,"dds":0.6030150753768844,"last_synced_commit":"a690317941b6b3a7960aed928eb02fb266d3277d"},"previous_names":[],"tags_count":38,"template":false,"template_full_name":null,"purl":"pkg:github/mcollina/msgpack5","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mcollina","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/sbom","scorecard":{"id":632405,"data":{"date":"2025-08-11","repo":{"name":"github.com/mcollina/msgpack5","commit":"2a1f2ac231920ec77cb722dee622c950a308b195"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.4,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":4,"reason":"Found 12/30 approved changesets -- score normalized to 4","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/mcollina/msgpack5/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/mcollina/msgpack5/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/mcollina/msgpack5/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:20","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'","Warn: branch protection not enabled for branch 'v4'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 13 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-21T08:17:45.255Z","repository_id":18722049,"created_at":"2025-08-21T08:17:45.255Z","updated_at":"2025-08-21T08:17:45.255Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344794859,"owners_count":38305396,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-14T02:00:06.392Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"mcollina","name":"Matteo Collina","uuid":"52195","kind":"user","description":"@platformatic Co-Founder \u0026 CTO, TSC member @nodejs, Lead Maintainer @fastify, Conference Speaker, Ph.D.","email":"matteo.collina@gmail.com","website":"nodeland.dev","location":"Forlì, Italy","twitter":"matteocollina","company":"@platformatic","icon_url":"https://avatars.githubusercontent.com/u/52195?v=4","repositories_count":654,"last_synced_at":"2026-10-09T10:56:56.725Z","metadata":{"has_sponsors_listing":true,"funding":{"github":["mcollina"]}},"html_url":"https://github.com/mcollina","funding_links":["https://github.com/sponsors/mcollina"],"total_stars":21136,"followers":11397,"following":473,"created_at":"2022-11-02T16:20:40.129Z","updated_at":"2026-10-09T10:56:56.739Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mcollina","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mcollina/repositories"},"tags":[{"name":"v6.1.0","sha":"3730a5a754ec06912e42865eed9489ed64238ecb","kind":"commit","published_at":"2026-09-26T10:52:36.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v6.1.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v6.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.1.0/manifests"},{"name":"v6.0.2","sha":"5cfdf2d7a66ebe0ef07f51d07ed3ec4d81273735","kind":"commit","published_at":"2022-07-15T08:21:57.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v6.0.2","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v6.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v6.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.0.2/manifests"},{"name":"v6.0.0","sha":"acc74111836f68c27ff6f57e0baeed5fe2f9402d","kind":"commit","published_at":"2022-04-12T18:52:35.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v6.0.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v6.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v6.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v6.0.0/manifests"},{"name":"v5.3.2","sha":"a2b7765dd887ea5e3c21344cf0b8f0296f17c3d0","kind":"commit","published_at":"2021-03-25T09:42:05.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.3.2","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.2/manifests"},{"name":"v4.5.1","sha":"1f7becdfc915646fc0947be3c9f6677e626e2b7b","kind":"commit","published_at":"2021-03-08T17:33:36.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.5.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.5.1/manifests"},{"name":"v5.3.1","sha":"a73f521f1c656dc83f0144fbff2ef528d4cd3ed0","kind":"commit","published_at":"2021-03-05T10:38:55.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.3.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.1/manifests"},{"name":"v3.6.1","sha":"a73f521f1c656dc83f0144fbff2ef528d4cd3ed0","kind":"commit","published_at":"2021-03-05T10:38:55.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.6.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.6.1/manifests"},{"name":"v5.3.0","sha":"2130d2c61e8e49f4891ec989524e82e6091352c5","kind":"commit","published_at":"2021-03-05T10:38:02.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.3.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.3.0/manifests"},{"name":"v5.2.1","sha":"0a925ea2151c96eae16961761f35e823e5f8b4d3","kind":"commit","published_at":"2021-03-05T10:22:28.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.2.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.2.1/manifests"},{"name":"v5.2.0","sha":"d2479effbe6ff51c41d1dbc42e3807c9452180fe","kind":"commit","published_at":"2021-03-02T11:44:57.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.2.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.2.0/manifests"},{"name":"v5.1.0","sha":"195cfc5212ef2174c32bce94e0f143f74d9dbf21","kind":"commit","published_at":"2021-02-11T14:53:19.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.1.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.1.0/manifests"},{"name":"v5.0.0","sha":"9fb92c3a0aa8adaf53862ebc5f8848795bf9f0fd","kind":"commit","published_at":"2020-12-30T11:01:15.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v5.0.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v5.0.0/manifests"},{"name":"v4.5.0","sha":"438762fd5b3d6fb21b2bc030185d020c1268c36b","kind":"commit","published_at":"2020-12-30T10:59:50.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.5.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.5.0/manifests"},{"name":"v4.4.0","sha":"3f11810c10fc87e2edfc968cbe16d407118818a1","kind":"commit","published_at":"2020-12-21T18:40:03.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.4.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.4.0/manifests"},{"name":"v4.3.0","sha":"d28d3fc22aa3bfa11d4191606ce13831de83dc84","kind":"commit","published_at":"2020-12-16T16:47:24.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.3.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.3.0/manifests"},{"name":"v4.2.0","sha":"569aa62bd86349286b140d683362fd3c3f32a374","kind":"commit","published_at":"2018-05-20T18:43:51.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.2.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.2.0/manifests"},{"name":"v4.1.0","sha":"db540b3264a1ab876b64dda2f1c413f590f5baa7","kind":"commit","published_at":"2018-05-17T12:00:31.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.1.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.1.0/manifests"},{"name":"v4.0.2","sha":"005eceb8fc1bcd6c4d3c3f7fd53792f928a00223","kind":"commit","published_at":"2018-03-12T17:31:51.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.0.2","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.2/manifests"},{"name":"v4.0.1","sha":"7bf37b4edce91c1d4e927cb93c1ca7e31bdeedc7","kind":"commit","published_at":"2018-01-13T11:18:34.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.0.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.1/manifests"},{"name":"v4.0.0","sha":"c504ca7e1133b517ac571a7eaed57c40fc14b316","kind":"commit","published_at":"2017-12-21T11:54:58.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v4.0.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v4.0.0/manifests"},{"name":"v3.6.0","sha":"cca202eaa250c2cafbc2170da7da29c31e8710ea","kind":"commit","published_at":"2017-10-29T11:11:24.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.6.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.6.0/manifests"},{"name":"v3.5.0","sha":"30702a6f909c578890ecb0adccdbb19a54ea3bf7","kind":"commit","published_at":"2017-07-17T08:28:16.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.5.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.5.0/manifests"},{"name":"v3.4.1","sha":"e56c0604bfff3e85a13e227c99b94962d3e1e005","kind":"commit","published_at":"2016-10-02T13:25:30.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.4.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.4.1/manifests"},{"name":"v3.4.0","sha":"3647ddd2a19641148254d526a6a2dde7e0c6ebe5","kind":"commit","published_at":"2016-06-22T15:09:28.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.4.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.4.0/manifests"},{"name":"v3.3.0","sha":"0b35d5333844c18df1c8502118ccab0851c0bcdc","kind":"commit","published_at":"2015-11-11T19:26:02.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.3.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.3.0/manifests"},{"name":"v3.2.0","sha":"ccaa02d3ffcad45b2ddb1193044daea2b5f4384c","kind":"commit","published_at":"2015-10-13T06:49:27.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.2.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.2.0/manifests"},{"name":"v3.1.0","sha":"223b6a65023383cd77717d562eb65a21c1a5a92d","kind":"commit","published_at":"2015-07-28T13:17:36.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.1.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.1.0/manifests"},{"name":"v3.0.0","sha":"c11aa63b20918cfe496fa55f91fcacd1182c31eb","kind":"commit","published_at":"2015-07-04T11:31:45.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v3.0.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v3.0.0/manifests"},{"name":"v2.3.1","sha":"21c753a56f822cb36130907ad9ea149b39349e46","kind":"commit","published_at":"2015-07-04T11:09:11.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v2.3.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v2.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.3.1/manifests"},{"name":"v2.3.0","sha":"6a1fdc7c7084f765416283f1d9b41f579c1c84ca","kind":"commit","published_at":"2015-05-22T13:53:21.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v2.3.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.3.0/manifests"},{"name":"v2.2.0","sha":"a03faa94b3e81e090866e535c5db1013d8c55f54","kind":"commit","published_at":"2015-05-06T13:46:52.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v2.2.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.2.0/manifests"},{"name":"v2.1.0","sha":"2d49f0797fb550d141b5456020f03fed26d5da3e","kind":"commit","published_at":"2015-04-10T06:58:52.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v2.1.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.1.0/manifests"},{"name":"v2.0.0","sha":"ea54d1f1857c61708f25a3b653df4fa6be3661c4","kind":"commit","published_at":"2015-02-15T09:17:53.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v2.0.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v2.0.0/manifests"},{"name":"v1.6.0","sha":"24aaf51bd537f47c9d5fd120d2032dade53d2e3a","kind":"commit","published_at":"2015-02-13T18:44:56.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v1.6.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.6.0/manifests"},{"name":"v1.5.0","sha":"3295e86d8f0c34fb7caad545096344536e8dac62","kind":"commit","published_at":"2015-02-08T09:55:31.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v1.5.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.5.0/manifests"},{"name":"v1.3.2","sha":"be833bbb4b9e3494c79c28bb808c8efb0aa78fe4","kind":"commit","published_at":"2014-11-18T11:48:24.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v1.3.2","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.3.2/manifests"},{"name":"v1.3.1","sha":"b613485ed932992656b310d04dd320ff0fb0ceca","kind":"commit","published_at":"2014-11-18T11:27:12.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v1.3.1","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.3.1/manifests"},{"name":"v1.2.0","sha":"db3e4bba19c1c9cf57aa7d1d16b2568cd8c3fd31","kind":"commit","published_at":"2014-10-07T15:34:38.000Z","download_url":"https://codeload.github.com/mcollina/msgpack5/tar.gz/v1.2.0","html_url":"https://github.com/mcollina/msgpack5/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mcollina/msgpack5@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/tags/v1.2.0/manifests"}]},"repo_metadata_updated_at":"2026-10-14T22:20:50.407Z","dependent_packages_count":225,"downloads":709912,"downloads_period":"last-month","dependent_repos_count":5622,"rankings":{"downloads":0.3469603977014644,"dependent_repos_count":0.3144276064131911,"dependent_packages_count":0.20992248757166956,"stargazers_count":3.066460765761941,"forks_count":3.3210697204053217,"docker_downloads_count":0.14548686681198542,"average":1.2340546407775956},"purl":"pkg:npm/msgpack5","advisories":[{"uuid":"GSA_kwCzR0hTQS04ZjM0LWY1NngtOXhwaM4AB8F1","url":"https://github.com/advisories/GHSA-8f34-f56x-9xph","title":"msgpack5: Truncated map32 headers throw an unexpected error","description":"### Impact\n\nA truncated `map32` header causes an out-of-bounds buffer read and throws `RangeError` instead of `IncompleteBufferError`. Applications that rely on `IncompleteBufferError` to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.\n\n### Patches\n\nThe decoder now validates the complete five-byte `map32` header before reading its length and reports truncated input as `IncompleteBufferError`.\n\n### Workarounds\n\nRequire at least five bytes before decoding a value beginning with `0xdf`, or catch `RangeError` and treat it as incomplete input only for truncated `map32` headers.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-08T17:40:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph","https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-8f34-f56x-9xph"],"source_kind":"github","identifiers":["GHSA-8f34-f56x-9xph","CVE-2026-107302"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.783Z","epss_percentage":0.00426,"epss_percentile":0.34917,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04ZjM0LWY1NngtOXhwaM4AB8F1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04ZjM0LWY1NngtOXhwaM4AB8F1","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04ZjM0LWY1NngtOXhwaM4AB8F1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01eDVnLWg5eDgtMmZoOc4AB8F0","url":"https://github.com/advisories/GHSA-5x5g-h9x8-2fh9","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","description":"### Impact\n\nThe streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.\n\n### Patches\n\nThe streaming decoder now drains concatenated values iteratively with constant call-stack depth.\n\n### Workarounds\n\nLimit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-08T17:40:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-5x5g-h9x8-2fh9","https://github.com/mcollina/msgpack5/commit/77fbef144d05def5d16fc22c37caa64c0a7efeba","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-5x5g-h9x8-2fh9"],"source_kind":"github","identifiers":["GHSA-5x5g-h9x8-2fh9","CVE-2026-107300"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.783Z","epss_percentage":0.00426,"epss_percentile":0.34916,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01eDVnLWg5eDgtMmZoOc4AB8F0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01eDVnLWg5eDgtMmZoOc4AB8F0","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01eDVnLWg5eDgtMmZoOc4AB8F0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNndxLXAyNWMtajZmds4AB8Fz","url":"https://github.com/advisories/GHSA-26wq-p25c-j6fv","title":"msgpack5: Reserved byte can cause unbounded stream buffering","description":"### Impact\n\nThe reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.\n\n### Patches\n\nThe decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.\n\n### Workarounds\n\nReject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:40:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv","https://github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-26wq-p25c-j6fv"],"source_kind":"github","identifiers":["GHSA-26wq-p25c-j6fv","CVE-2026-107299"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.784Z","epss_percentage":0.00389,"epss_percentile":0.30898,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNndxLXAyNWMtajZmds4AB8Fz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNndxLXAyNWMtajZmds4AB8Fz","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNndxLXAyNWMtajZmds4AB8Fz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04aHE3LWdneDItY2M2bc4AB8Fy","url":"https://github.com/advisories/GHSA-8hq7-ggx2-cc6m","title":"msgpack5: Partial options disable prototype protection","description":"### Impact\n\nPassing an empty or partial options object disables the default `protoAction: 'error'` protection. A map containing a `__proto__` key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.\n\nOnly the decoded object's prototype is affected; this does not modify `Object.prototype` globally.\n\n### Patches\n\nOptions are now merged with secure defaults without modifying the caller's object. Unsupported `protoAction` values are rejected.\n\n### Workarounds\n\nExplicitly set `protoAction: 'error'` whenever constructing a msgpack5 instance, and validate decoded values before use.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:39:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m","https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-8hq7-ggx2-cc6m"],"source_kind":"github","identifiers":["GHSA-8hq7-ggx2-cc6m","CVE-2026-107301"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.784Z","epss_percentage":0.00366,"epss_percentile":0.28516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04aHE3LWdneDItY2M2bc4AB8Fy","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04aHE3LWdneDItY2M2bc4AB8Fy","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04aHE3LWdneDItY2M2bc4AB8Fy/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNGNoLWYyZzYtOWhoaM4AB8Fx","url":"https://github.com/advisories/GHSA-24ch-f2g6-9hhh","title":"msgpack5: Deeply nested input can exhaust the decoder stack","description":"### Impact\n\nThe decoder has no nesting-depth limit for arrays and maps. An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.\n\n### Patches\n\nThe decoder now limits nesting depth to 100 by default and throws `Maximum decode depth exceeded`. Applications can configure the limit with the `maxDepth` option.\n\n### Workarounds\n\nReject deeply nested input before decoding, isolate decoding in a worker, or enforce a trusted schema with a bounded nesting depth.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:39:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-24ch-f2g6-9hhh","https://github.com/mcollina/msgpack5/commit/1e2b5874e555dd7c99417f64788a03b0590bb102","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-24ch-f2g6-9hhh"],"source_kind":"github","identifiers":["GHSA-24ch-f2g6-9hhh","CVE-2026-107298"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.784Z","epss_percentage":0.00372,"epss_percentile":0.29062,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNGNoLWYyZzYtOWhoaM4AB8Fx","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNGNoLWYyZzYtOWhoaM4AB8Fx","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNGNoLWYyZzYtOWhoaM4AB8Fx/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nY3g1LWh4ajctZ3Bxcc4AB8Fw","url":"https://github.com/advisories/GHSA-gcx5-hxj7-gpqq","title":"msgpack5: Quadratic parsing in the streaming decoder","description":"### Impact\n\nThe streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.\n\n### Patches\n\nThe decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.\n\n### Workarounds\n\nBuffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-08T17:39:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-gcx5-hxj7-gpqq","https://github.com/mcollina/msgpack5/commit/e4827641d3105e295cbbd56e9c5389978547eab4","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-gcx5-hxj7-gpqq"],"source_kind":"github","identifiers":["GHSA-gcx5-hxj7-gpqq","CVE-2026-107297"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-12T08:00:21.785Z","epss_percentage":0.00389,"epss_percentile":0.30898,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nY3g1LWh4ajctZ3Bxcc4AB8Fw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nY3g1LWh4ajctZ3Bxcc4AB8Fw","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nY3g1LWh4ajctZ3Bxcc4AB8Fw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xdzM1LTU1dmMtcmhnas4AB8Fv","url":"https://github.com/advisories/GHSA-qw35-55vc-rhgj","title":"msgpack5: Decoding negative int64 values mutates the input buffer","description":"### Impact\n\nDecoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer. Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data.\n\nPositive integers and other MessagePack value types are not affected.\n\n### Patches\n\nThe decoder now computes signed 64-bit values without writing to the input buffer.\n\n### Workarounds\n\nCopy untrusted MessagePack input before decoding it, or do not retain or reuse input buffers after decoding.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-10-08T17:39:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":3.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-qw35-55vc-rhgj","https://github.com/mcollina/msgpack5/commit/82b70393a824e1088a45a377548d1d9ab82faf91","https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","https://github.com/advisories/GHSA-qw35-55vc-rhgj"],"source_kind":"github","identifiers":["GHSA-qw35-55vc-rhgj","CVE-2026-107296"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-08T18:00:10.215Z","updated_at":"2026-10-14T10:00:30.103Z","epss_percentage":0.00276,"epss_percentile":0.18511,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xdzM1LTU1dmMtcmhnas4AB8Fv","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xdzM1LTU1dmMtcmhnas4AB8Fv","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"6.1.0","vulnerable_version_range":"\u003c 6.1.0"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xdzM1LTU1dmMtcmhnas4AB8Fv/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdtanctNDlwNC1wY2Zt","url":"https://github.com/advisories/GHSA-gmjw-49p4-pcfm","title":"Prototype poisoning","description":"### Impact\n\nThe issue is as follows: when `msgpack5` decodes a map containing a \nkey `\"__proto__\"`, it assigns the decoded value to `__proto__`. As you \nare no doubt aware, `Object.prototype.__proto__` is an accessor \nproperty for the receiver's prototype. If the value corresponding to \nthe key `__proto__` decodes to an object or `null`, `msgpack5` sets \nthe decoded object's prototype to that value. \n\nAn attacker who can submit crafted MessagePack data to a service can \nuse this to produce values that appear to be of other types; may have \nunexpected prototype properties and methods (for example `length`, \nnumeric properties, and `push` et al if `__proto__`'s value decodes to \nan `Array`); and/or may throw unexpected exceptions when used (for \nexample if the `__proto__` value decodes to a `Map` or `Date`). Other \nunexpected behavior might be produced for other types. \n\nThere is no effect on the global prototype.\n\nAn example: \n\n```js \nconst msgpack5 = require('msgpack5')(); \n\nconst payload = {}; \nObject.defineProperty(payload, '__proto__', { \nvalue: new Map().set(1, 2), \nenumerable: true \n}); \n\nconst encoded = msgpack5.encode(payload); \nconsole.log(encoded); // \u003cBuffer 81 a9 5f 5f 70 72 6f 74 6f 5f 5f 81 01 02\u003e \n\nconst decoded = msgpack5.decode(encoded); \n\n// decoded's prototype has been overwritten \nconsole.log(Object.getPrototypeOf(decoded)); // Map(1) { 1 =\u003e 2 } \nconsole.log(decoded.get); // [Function: get] \n\n// decoded appears to most common typechecks to be a Map \nconsole.log(decoded instanceof Map); // true \nconsole.log(decoded.toString()); // [object Map] \nconsole.log(Object.prototype.toString.call(decoded)); // [object Map] \nconsole.log(decoded.constructor.name); // Map \nconsole.log(Object.getPrototypeOf(decoded).constructor.name); // Map \n\n// decoded is not, however, a Map \nconsole.log(Object.getPrototypeOf(decoded) === Map.prototype); // false \n\n// using decoded as though it were a Map throws \ntry { \ndecoded.get(1); \n} catch (error) { \nconsole.log(error); // TypeError: Method Map.prototype.get called \n// on incompatible receiver #\u003cMap\u003e \n} \ntry { \ndecoded.size; \n} catch (error) { \nconsole.log(error); // TypeError: Method get Map.prototype.size \n// called on incompatible receiver #\u003cMap\u003e \n} \n\n// re-encoding the decoded value throws \ntry { \nmsgpack5.encode(decoded); \n} catch (error) { \nconsole.log(error); // TypeError: Method Map.prototype.entries \n// called on incompatible receiver #\u003cMap\u003e \n} \n``` \n\nThis \"prototype poisoning\" is sort of a very limited inversion of a \nprototype pollution attack. Only the decoded value's prototype is \naffected, and it can only be set to `msgpack5` values (though if the \nvictim makes use of custom codecs, anything could be a `msgpack5` \nvalue). We have not found a way to escalate this to true prototype \npollution (absent other bugs in the consumer's code). \n\n### Patches\n\nVersions v5.2.1, v4.5.1, v3.6.1 include the fix.\n\n### Workarounds\n\nAlways validate incoming data after parsing before doing any processing.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-03-12T22:44:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H","references":["https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm","https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8","https://github.com/mcollina/msgpack5/releases/tag/v3.6.1","https://github.com/mcollina/msgpack5/releases/tag/v4.5.1","https://github.com/mcollina/msgpack5/releases/tag/v5.2.1","https://www.npmjs.com/package/msgpack5","https://nvd.nist.gov/vuln/detail/CVE-2021-21368","https://github.com/advisories/GHSA-gmjw-49p4-pcfm"],"source_kind":"github","identifiers":["GHSA-gmjw-49p4-pcfm","CVE-2021-21368"],"repository_url":"https://github.com/mcollina/msgpack5","blast_radius":0.0,"created_at":"2022-12-21T16:13:11.050Z","updated_at":"2026-10-15T11:19:54.822Z","epss_percentage":0.01649,"epss_percentile":0.75501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdtanctNDlwNC1wY2Zt","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdtanctNDlwNC1wY2Zt","packages":[{"ecosystem":"npm","package_name":"msgpack5","versions":[{"first_patched_version":"5.2.1","vulnerable_version_range":"\u003e= 5.0.0, \u003c 5.2.1"},{"first_patched_version":"4.5.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.5.1"},{"first_patched_version":"3.6.1","vulnerable_version_range":"\u003c 3.6.1"}],"purl":"pkg:npm/msgpack5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdtanctNDlwNC1wY2Zt/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/msgpack5","docker_dependents_count":162,"docker_downloads_count":202225637,"usage_url":"https://repos.ecosyste.ms/usage/npm/msgpack5","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/msgpack5/dependencies","status":null,"funding_links":["https://github.com/sponsors/mcollina"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-14T06:21:28.880Z","issues_count":54,"pull_requests_count":50,"avg_time_to_close_issue":5858772.775,"avg_time_to_close_pull_request":1350400.82,"issues_closed_count":40,"pull_requests_closed_count":50,"pull_request_authors_count":33,"issue_authors_count":49,"avg_comments_per_issue":2.888888888888889,"avg_comments_per_pull_request":2.76,"merged_pull_requests_count":43,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":2,"past_year_pull_requests_count":2,"past_year_avg_time_to_close_issue":1127.0,"past_year_avg_time_to_close_pull_request":45269.0,"past_year_issues_closed_count":1,"past_year_pull_requests_closed_count":2,"past_year_pull_request_authors_count":1,"past_year_issue_authors_count":1,"past_year_avg_comments_per_issue":0.5,"past_year_avg_comments_per_pull_request":0.0,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":2,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcollina%2Fmsgpack5/issues","maintainers":[{"login":"mcollina","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mcollina"},{"login":"shinichy","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/shinichy"}],"active_maintainers":[{"login":"mcollina","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mcollina"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/msgpack5/codemeta","maintainers":[{"uuid":"matteo.collina","login":"matteo.collina","name":null,"email":"hello@matteocollina.com","url":null,"packages_count":651,"html_url":"https://www.npmjs.com/~matteo.collina","role":null,"created_at":"2022-11-10T21:50:24.844Z","updated_at":"2022-11-10T21:50:24.844Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/matteo.collina/packages"}]}