JavaScript TOML Parser Vulnerability in js-toml by SunnyAdn

CVE-2026-50029

What is CVE-2026-50029?

The js-toml parser exhibits a vulnerability arising from its handling of duplicate keys within TOML configuration files. In versions prior to 1.1.2, the check for existing keys uses a faulty condition, allowing the parser to overlook existing keys when their current values are falsy. This results in a severe risk where keys provided by an attacker can overwrite valid existing keys without raising a parse error, thus creating structural confusion in the parsed output. The oversight permits unintended truthy evaluations in applications relying on specific configurations, potentially leading to unauthorized access or execution of unintended logic. Version 1.1.2 resolves this issue by implementing a correct key existence check.

References