Security fix · CVE-2026-114142
toml-node is a TOML parser for Node.js and the browser.
Published Oct 21, 2026 · catalog updated Oct 26, 2026 · toml-node is a TOML
Last checked Nov 5, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-114142. EPSS is 0.51%. Act only if a listed version of toml-node is a TOML is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (toml-node is a TOML).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High8.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.51%
- Remediation
- Version ranges on file
- Affected products
- npm tome · npm toml · package npm
### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries. ### Details Three gaps compose. All line numbers are in 5.0.0. **1. The path-key encoding is ambiguous.** quotes a segment only when it contains a , and never escapes a inside the segment: So the key path and the key path both render as the string . This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot. **2. A table-array header can clear another key's guard.** walks / with over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry. **3. The descent in has no owned-container check.** applies only to intermediate segments ( , ) and returns the final container unchecked. then walks it with only a shape test: A TOML datetime is a . It satisfies and is not an array, so the walk descends into it — and a has a live prototype chain to . Putting the three together, a document can make the current table a and then walk to . Line 1 defines a key whose rendered path is and whose value is a . Line 2 is a table-array header whose rendered path collides with it, clearing its guard. Line 3 re-enters that key, so the current table is now the . Line 4 walks → → . The payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched. A useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing ste
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm tome<= 5.0.0
- npm toml0 → 5.0.1
- package npmversion unspecified
How to fix CVE-2026-114142
Upgrade
CVE-2026-114142 lists a fix boundary at 5.0.0. Compare the installed build with that boundary before you change production.
Version check
Affected <= 5.0.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-114142. EPSS is 0.51%. Act only if a listed version of toml-node is a TOML is installed.
Which versions are affected?
Compare what you have installed with <= 5.0.0, 0 → 5.0.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). EPSS 0.51%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 21, 2026 · NIST NVD
Detected
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the o
Oct 22, 2026 · GitHub Advisory Database
Updated
### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with to
Oct 26, 2026 · GitHub Advisory Database
Fix available
toml fixed in 5.0.1
Oct 26, 2026 · GitHub Advisory Database
Fix available
toml fixed in 5.0.1
Oct 26, 2026 · GitHub Advisory Database
Updated
### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with to
Sources
- CVE.orgVulnerability recordCVE-2026-114142
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-114142
30-day exploitation probability 0.51%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-h895-cgqg-jf52
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-114142
CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() write
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-114142
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableAr
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-h895-cgqg-jf52
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
osv.dev - Snyk Vulnerability DatabasePackage advisorySNYK-JS-TOML-21431470
Prototype Pollution
security.snyk.io
References
Freshness
Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 5, 2026
- GitHub Advisory DatabaseOct 26, 2026
- OpenSSF OSV / OSV ScannerOct 26, 2026
- Snyk Vulnerability DatabaseOct 25, 2026
- GitLab Advisory DatabaseOct 23, 2026
- CVE.orgOct 22, 2026
- NIST NVDOct 22, 2026