CVE-2026-50029

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.2

Description The interpreter incorrectly verifies if a key already exists in a parser-built container by using if (object[key]) instead of if (key in object). When a key is assigned a falsy primitive value—such as false, 0, 0n, 0.0, -0, or ""—the duplicate-key check is bypassed. This allows the value to be silently overwritten by a subsequent sub-table, dotted-key sub-table, or array-of-tables using the same name, which violates the TOML 1.0.0 specification stating that defining a key multiple times is invalid.

This leads to structural type confusion in the value returned by the load() function, where a falsy primitive (like a boolean false) is converted into a truthy object. Consequently, host applications that rely on these values for logic gating (e.g., if (config.flag)) may inadvertently execute the truthy branch. The issue is present in the Interpreter.tryCreatingObject() and Interpreter.getOrCreateArray() functions.

Recommendations Update js-toml to version 1.1.2.