Object Prototype Manipulation in toml-node by BinaryMuse

CVE-2026-114142

What is CVE-2026-114142?

The toml-node package for Node.js and the browser contains a vulnerability where the toml.parse() function can overwrite properties of Object.prototype. This occurs due to a flaw in the quoteDottedString() method in lib/compiler.js, which erroneously produces the same bookkeeping string for different key paths. As a result, the addTableArray() function can inadvertently clear a guard on another key, allowing the assign() method to descend through a Date value without proper checks. Consequently, objects created in other contexts may inherit the properties injected by an attacker. This issue has been addressed in version 5.0.1.

References