CVE-2021-48012: fast-toml through 0.5.4 Prototype Pollution via proto Keys in Parsed TOML

Q: Which applications are exposed to this issue?

Applications using npm/fast-toml through version 0.5.4 are exposed when they pass attacker-controlled TOML content to the library's parse() function.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.

Q: What TOML input patterns should be treated as malicious?

Reject or sanitize TOML containing __proto__, constructor, or prototype key segments. Known dangerous forms include [__proto__] and [constructor.prototype] table headers, as well as dotted keys such as __proto__.x.

Q: What can be done if upgrading is not immediately possible?

Do not parse untrusted TOML with the affected library. If untrusted TOML must be accepted, validate and reject keys or table-header segments named __proto__, constructor, or prototype before calling parse().

Q: How can teams determine whether they may already be affected?

Check whether fast-toml through 0.5.4 is installed and whether any code path sends externally supplied TOML to parse(). Review accepted TOML documents and logs for the dangerous table headers or dotted key patterns.

Published Oct 12, 2026

Updated

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prototype key segments. Attackers can pass [proto] or [constructor.prototype] table headers or proto.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

Affected Software

1 affected component

npm/fast-toml<=0.5.4

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using npm/fast-toml through version 0.5.4 are exposed when they pass attacker-controlled TOML content to the library's parse() function.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.

What TOML input patterns should be treated as malicious?

Reject or sanitize TOML containing __proto__, constructor, or prototype key segments. Known dangerous forms include [__proto__] and [constructor.prototype] table headers, as well as dotted keys such as __proto__.x.

What can be done if upgrading is not immediately possible?

Do not parse untrusted TOML with the affected library. If untrusted TOML must be accepted, validate and reject keys or table-header segments named __proto__, constructor, or prototype before calling parse().

How can teams determine whether they may already be affected?

Check whether fast-toml through 0.5.4 is installed and whether any code path sends externally supplied TOML to parse(). Review accepted TOML documents and logs for the dangerous table headers or dotted key patterns.

CVE-2021-48012: fast-toml through 0.5.4 Prototype Pollution via proto Keys in Parsed TOML

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What TOML input patterns should be treated as malicious?

What can be done if upgrading is not immediately possible?

How can teams determine whether they may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What TOML input patterns should be treated as malicious?

What can be done if upgrading is not immediately possible?

How can teams determine whether they may already be affected?

CVE-2021-48012: fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What TOML input patterns should be treated as malicious?

What can be done if upgrading is not immediately possible?

How can teams determine whether they may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What TOML input patterns should be treated as malicious?

What can be done if upgrading is not immediately possible?

How can teams determine whether they may already be affected?

CVE-2021-48012: fast-toml through 0.5.4 Prototype Pollution via proto Keys in Parsed TOML