Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries. Details Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0. 1. The path-key encoding is ambiguous. `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment: ```js 287: function quoteDottedString(str) { 288: if (str.indexOf(".") > -1) { 289: return "\"" + str + "\""; 290: } else { 291: return str; 292: } 293: } ``` So the key path `['x.y']` and the key path…
Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables ([[name]]) headers. addTableArray() in lib/compiler.js rescans two entire bookkeeping Sets on every [[name]] header without pruning unrelated or distinct entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections), not a contrived edge case. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) and requires no key nesting or dotted keys at all. Affected component / version - Package: toml (npm), repository BinaryMuse/toml-node - Function: addTableArray() in lib/compiler.js - Confirmed present in the audited checkout at commit 1b2ac40 (2026-07-16), one commit past the v5.0.0 tag (a changelog-only change) — i.e.…
Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the maxDepth option that fixed that earlier issue. Affected component / version - Package: toml (npm), repository BinaryMuse/toml-node - Functions: assign(), deepRef(), setNestedKey() in lib/compiler.js - Confirmed present in the audited checkout at commit 1b2ac40 (2026-07-16), one commit past the v5.0.0 tag (a changelog-only change) — i.e. present in v5.0.0, the latest release. Not exhaustively verified against every prior release, but the affected functions are unrelated to v5.0.0's…
Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
toml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or complex crafting is required. Details In lib/parser.js, the grammar actions that build integer nodes call BigInt() directly on the matched digit text, with no upper bound on its length: - lib/parser.js:326 — hex: BigInt('0x' + stripUnderscores(digits)) - lib/parser.js:327 — octal: BigInt('0o' + stripUnderscores(digits)) - lib/parser.js:328 — binary: BigInt('0b' + stripUnderscores(digits)) - lib/parser.js:329 — decimal: BigInt(stripUnderscores(text)) The parser does enforce a nesting-depth…
Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
toml.parse() crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 (a PEG parser generator) as a recursive-descent parser; the value rule mutually recurses with the array and inline-table rules with no depth limit, so nesting depth equal to the input depth exhausts Node's call stack. A small payload — a bare array nested a few thousand levels deep (~5–6 KB) — reliably crashes the process on a default Node.js configuration. toml has ~47 million monthly downloads. --- Vulnerable Code The parser is a generated recursive-descent parser (lib/parser.js, header: // @generated by Peggy 5.1.0.). The recursion sink is the mutual recursion between the value, array, and inlinetable rule functions — none carry a depth counter: Recursion cycle for a=[[[ … ]]] (bare nested arrays): Inline tables ({arr=[ … ]}, {a={a= … }}) reach the same cycle via peg$parseinlinetable /…
Recommended action: Upgrade to 4.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
toml.parse() writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.create(null), which neutralizes a direct [proto] table. An attacker bypasses that protection by routing a table path through a scalar value and into the real prototype chain: a path such as a.b.y.proto.proto, where a.b.y holds a number, resolves to Object.prototype and every subsequent key/value writes onto it. The bypass succeeds because the compiler's duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings desynchronize, so the guard that should reject descending through an existing scalar never fires. Steps to reproduce 1. Install the latest version and run the comma-desynchronization payload. 2. Observe that a freshly created object inherits the injected key, confirming Object.prototype was modified: 3. Confirm the prefix-clear variant reaches the same…
Recommended action: Upgrade to 4.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.