CVE-2026-114142: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
toml-nodeto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using npm/toml-node versions earlier than 5.0.1 are affected if they parse TOML documents with toml.parse(). The parser is used in both Node.js and browser contexts, and injected properties can be inherited by objects created elsewhere in the same process.
What must an attacker be able to do to exploit this?
An attacker needs to cause the application to parse an attacker-controlled TOML document with toml.parse(). Exploitation relies on crafted quoted dotted key paths that bypass the parser's bookkeeping and reach the prototype chain.
What should be done if the application parses untrusted TOML?
Upgrade toml-node to version 5.0.1. Until that is possible, do not pass attacker-controlled TOML documents to toml.parse().
How can teams determine whether they are affected?
Identify whether the application depends on npm/toml-node before version 5.0.1 and calls toml.parse() on TOML content that an attacker can influence. Review the process for unexpected inherited properties on newly created objects after parsing such input.