CVE-2026-107296

Low

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

msgpack5: Decoding negative int64 values mutates the input buffer

Carried by container images the latest versions of 3 of 18,090 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
msgpack5npm	3.6.1, 4.5.1	6.1.0	2

3 by stars

Chart

Latest

Affected images

Radar Score

zwavejs2mqttgeek-cookbook

1 of the 1 container images this version deploys carry CVE-2026-107296.

Container image	Digest	Package	Fixed in
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	msgpack5@3.6.1	6.1.0

3,729

1 of the 1 container images this version deploys carry CVE-2026-107296.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	msgpack5@4.5.1	6.1.0

15,260

1 of the 3 container images this version deploys carry CVE-2026-107296.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	msgpack5@4.5.1	6.1.0

30,478

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
hookiesolutions/webhookie :latest	0629694246ba	msgpack5@4.5.1	6.1.0	2
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	msgpack5@3.6.1	6.1.0	1