CVE-2021-48012 Details

A prototype pollution vulnerability has been identified in the fast-toml TOML parser for Node.js, affecting versions through 0.5.4. This vulnerability allows attackers to modify Object.prototype by injecting TOML that includes __proto__, constructor, or prototype key segments. Exploitation can be achieved by using [__proto__] or [constructor.prototype] table headers, or by employing __proto__.x dotted keys. The resulting prototype pollution can lead to various issues, including denial-of-service conditions or bypassing authorization mechanisms.

Users can address this vulnerability by updating to fast-toml version 0.5.5 or later, where the prototype pollution issue has been fixed. For those unable to update, a manual workaround involves filtering out dangerous keys such as __proto__, constructor, and prototype before parsing TOML input.