Read the docs
TI-2026-78986 Aliases CVE-2026-114142GHSA-h895-cgqg-jf52

Prototype pollution in toml-node parser writes to Object.prototype

Priority MEDIUM 47CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

toml-node before 5.0.1 (npm package toml, versions from 0 before 5.0.1) is affected. Its toml.parse() function mishandles distinct quoted key paths, which lets a crafted TOML document write attacker-controlled properties to Object.prototype (CWE-1321). A remote unauthenticated attacker who gets a TOML document parsed can alter objects created elsewhere in the process, which inherit the injected property.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Fixed toml-node (BinaryMuse): 5.0.1toml (npm): 5.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BinaryMusetoml-nodebefore 5.0.15.0.1Patch availableCNA
—toml (npm)before 5.0.15.0.1Patch availableGHSA-h895-cgqg-jf52
  • toml-node VendorBinaryMuse Affected before 5.0.1 Fixed in 5.0.1 Patch available CNA
  • toml (npm) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-h895-cgqg-jf52

Remediation

The npm package toml is fixed in version 5.0.1. The sources list no fixed version for toml-node.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA toml-node (BinaryMuse) Fixed in 5.0.1
  • Fix · GHSA-h895-cgqg-jf52 toml (npm) Fixed in 5.0.1 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114142
  2. 2026-10-22 Alias added: GHSA-h895-cgqg-jf52
  3. 2026-10-22 Fix available: npm/[email protected] · GHSA-h895-cgqg-jf52
  4. 2026-10-22 CVSS score added · GHSA-h895-cgqg-jf52
  5. 2026-10-22 Weakness changed · GHSA-h895-cgqg-jf52
  6. 2026-10-22 5 new references · GHSA-h895-cgqg-jf52
  7. 2026-10-23 Priority changed: MEDIUM → LOW
  8. 2026-10-28 CISA SSVC decision points changed
  9. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 4

  • TI-2026-78987 Quadratic complexity denial of service in toml-node TOML parser CVSS 4.0HIGH 8.7
  • TI-2026-45178 toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization CVSS 3.1HIGH 8.2
  • TI-2026-78988 CPU denial of service in toml-node via long integer literals CVSS 3.1HIGH 7.5
  • TI-2026-78985 Quadratic complexity in toml-node allows denial of service CVSS 4.0HIGH 8.7
  • TI-2026-54014 toml-node: Uncontrolled Recursion CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences