TOML Parser Vulnerability Exploiting Node.js and Browser by BinaryMuse

CVE-2026-63376

What is CVE-2026-63376?

The toml-node parser for Node.js has a vulnerability that may allow attackers to manipulate the Object.prototype and Number.prototype via crafted TOML input. Prior to version 4.1.2, an attacker can leverage the capabilities of toml.parse() to execute prototype pollution through conceptual table paths. This flaw can result in severe consequences, including unauthorized access, logical inconsistencies, or denial of service within the Node.js application context. Effective countermeasures have been implemented in the latest release to remedy this security weakness.

References