Impact
Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.
Only the decoded object's prototype is affected; this does not modify Object.prototype globally.
Patches
Options are now merged with secure defaults without modifying the caller's object. Unsupported protoAction values are rejected.
Workarounds
Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.
References
Impact
Passing an empty or partial options object disables the default
protoAction: 'error'protection. A map containing a__proto__key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.Only the decoded object's prototype is affected; this does not modify
Object.prototypeglobally.Patches
Options are now merged with secure defaults without modifying the caller's object. Unsupported
protoActionvalues are rejected.Workarounds
Explicitly set
protoAction: 'error'whenever constructing a msgpack5 instance, and validate decoded values before use.References