CyberRota Analysis
AI-GeneratedThe msgpack5 library for Node.js and browsers contains a vulnerability that affects the decoding of negative signed 64-bit integers, leading to unintended modifications of the input buffer. This can result in silently corrupted data, particularly for applications that rely on the integrity of encoded input for checks or logging. Developers using versions prior to 6.1.0 should prioritize upgrading to mitigate potential data integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.