msgpack5 is a MessagePack implementation for Node.js and browsers. The library had a flaw where initializing the decoder with an empty or partially specified options object disables the default prototype-protection guard that rejects payload fragments containing a '__proto__' key. Consequently, an attacker can provide a crafted MessagePack payload that modifies the prototype chain of the decoded object, potentially altering inherited properties and affecting downstream logic. This vulnerability maps to CWE-1321: Prototype Pollution.

Affected product is msgpack5 v6.0.x and earlier (up to 6.0.999). The fix is incorporated in version 6.1.0 and later. The risk applies to Node.js and browser deployments that employ msgpack5 via the mcollina/mcollina repository.

The CVSS score is 6.5, indicating medium severity. No EPSS score is reported, so the current exploitation probability is unknown. It is not listed in the CISA KEV catalog. If an application creates a msgpack5 instance with an empty or missing options object, an attacker who can supply a crafted payload can influence prototype inheritance, possibly leading to undesired logic or privileged actions depending on downstream use. The primary risk mitigated by applying the 6.1.0 patch or ensuring prototypes are protected.