toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BinaryMuse | toml-node | before 4.1.2 | 4.1.2 | Patch available | CNA |
| — | toml (npm) | before 4.1.2 | 4.1.2 | Patch available | GHSA-v5mp-jgw5-2x6j |
- toml-node VendorBinaryMuse Affected before 4.1.2 Fixed in 4.1.2 Patch available CNA
- toml (npm) Vendor— Affected before 4.1.2 Fixed in 4.1.2 Patch available GHSA-v5mp-jgw5-2x6j
Remediation
- Fix · CNA toml-node (BinaryMuse) Fixed in 4.1.2
- Fix · GHSA-v5mp-jgw5-2x6j toml (npm) Fixed in 4.1.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63376
- 2026-10-03 Alias added: GHSA-v5mp-jgw5-2x6j
References
More BinaryMuse vulnerabilities
- TI-2026-78987 Quadratic complexity denial of service in toml-node TOML parser CVSS 4.0HIGH 8.7
- TI-2026-78988 CPU denial of service in toml-node via long integer literals CVSS 3.1HIGH 7.5
- TI-2026-78986 Prototype pollution in toml-node parser writes to Object.prototype CVSS 4.0HIGH 8.8
- TI-2026-78985 Quadratic complexity in toml-node allows denial of service CVSS 4.0HIGH 8.7
- TI-2026-54014 toml-node: Uncontrolled Recursion CVSS 3.1HIGH 7.5
Sources
- CVE-2026-63376 · CVE Program
- CVE-2026-63376 · NVD
- FIRST EPSS
- GHSA-v5mp-jgw5-2x6j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63376 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences