CVE-2026-114142 Details
Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
A prototype pollution vulnerability has been identified in toml-node, a TOML parser for Node.js and the browser, affecting versions prior to 5.0.1. The issue arises because the function quoteDottedString() in lib/compiler.js generates the same string for different quoted key paths. This flaw allows a table-array header to clear the guard on an unrelated key, enabling the assign() function to traverse an unowned Date object and inject properties into Object.prototype. As a result, objects created during this process can inherit the polluted properties, potentially leading to unauthorized access or manipulation.
Users are advised to update to toml-node version 5.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606 | [email protected] | Source CodeVendor |
| https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1 | [email protected] | Release NotesVendor |
| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BinaryMuse toml-node | <= 5.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |