toml-node: Prototype pollution via crafted TOML document
Summary
toml-node is a TOML parser for Node.js and the browser. In versions before 5.0.1, a crafted TOML document passed to toml.parse() can write attacker-controlled properties to Object.prototype. Objects created elsewhere in the same process can then inherit the injected properties, which may affect application logic or security checks.
Affected
- toml-node (npm package "toml") versions before 5.0.1
- Versions 4.x need to move to the 5.x line; the related flaw CVE-2026-63376 was fixed in 4.1.2 only
- Unknown whether other release lines received backports
Fixed in
- Version 5.0.1 (commit 609c873)
Workaround
- Unknown. No vendor workaround is documented; upgrading is the documented fix.
Exploitation
- No active exploitation reported; CISA KEV status unknown.
- A public proof of concept exists in the GitHub advisory.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory Node.js projects and lockfiles for toml or toml-node versions 5.0.0 or earlier, including transitive dependencies.
- Upgrade to 5.0.1 or later; use dependency overrides where needed.
- Prioritise internet-facing applications and code that parses user-supplied TOML.
- Do not parse TOML from untrusted sources until the upgrade is complete.
- Note that the same release also fixes CVE-2026-114143 and CVE-2026-114144.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h895-cgqg-jf52 github.com
- Release v5.0.1 github.com
- Fix commit 609c873 github.com
- OSV GHSA-h895-cgqg-jf52 osv.dev
- npm package toml www.npmjs.com
- Vulners CVE-2026-114142 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:06.
Original description (NVD)
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.