CVE-2026-63376

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.1.2

Description the toml.parse() function in lib/compiler.js allows an attacker to write arbitrary keys onto Object.prototype by routing a table path through a scalar value. This occurs because the deepRef() function treats proto, constructor, and prototype as ordinary traversable keys. When a path such as a.b.y. proto . proto is used where a.b.y is a number, the traversal reaches Number.prototype and then Object.prototype.

This is made possible by a desynchronization in how the compiler tracks paths. The currentPath variable is assigned as both an array and a string, causing the duplicate-key guard to record paths using commas (e.g., a,b.y) while the deepRef() function checks for paths using dots (e.g., a.b.y). Consequently, the guard fails to detect the redefinition of an existing key. Additionally, a prefix-clearing mechanism in addTableArray() can erase guard state before a proto traversal.

Injected properties are visible throughout the entire Node.js process, which can lead to denial of service, logic or authorization bypass, or remote code execution if the application contains a suitable gadget.

Recommendations Update to version 4.1.2.