Prototype Pollution Vulnerability in fast-toml

The fast-toml library (all versions through 0.5.4) contains a prototype pollution vulnerability that allows attackers to manipulate the base Object.prototype. By supplying TOML data containing specific key segments such as "proto", "constructor", or "prototype", an attacker can influence the behavior of all objects within the JavaScript runtime. Specifically, passing "[proto]" or "[constructor.prototype]" as table headers, or using "proto.x" as dotted keys during the parse() process, triggers the vulnerability. This flaw poses a significant risk to applications that process untrusted TOML data, as it can be leveraged to achieve authorization bypass or cause denial of service conditions by disrupting expected object properties.

Impact

Successful exploitation allows for the modification of the global Object.prototype, which can cause downstream application logic errors, denial of service, or authorization bypasses in environments utilizing fast-toml to process external or untrusted data. There is no specific victim sector reported, but any node-based application relying on this dependency for configuration or data parsing is at risk.

Recommendation

Prioritized actions for development and security engineering teams:

• Identify all instances of the fast-toml dependency within the software bill of materials (SBOM) and update to a version beyond 0.5.4 if a patch is available.
• Implement input validation on all TOML data processed by the application to explicitly reject keys containing "proto", "constructor", or "prototype".
• Perform dependency auditing to determine if fast-toml is included as a transitive dependency in other packages.