toml: Prototype pollution via ambiguous TOML key paths (CVE-2026-114142)
The toml package is vulnerable to prototype pollution, allowing unauthorized injection of properties into Object.prototype via maliciously crafted TOML documents.
CVE search metadata
CVE search record: CVE-2026-114142. EPSS: 0.32%. KEV: no. Product: toml (<= 5.0.0). Brief: toml: Prototype pollution via ambiguous TOML key paths (CVE-2026-114142). Brief link: https://feed.craftedsignal.io/briefs/2026-10-toml-node-prototype-pollution/
Triage facts
Revision 1- Applicability
- toml (<= 5.0.0)
- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 06:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The toml package (up to and including version 5.0.0) is susceptible to prototype pollution. The vulnerability arises from ambiguous key-path encoding where quoteDottedString() fails to escape double quotes, leading to path desynchronization. Combined with a table-array header that can clear security guards and a lack of isOwnedContainer checks during the assign() descent, an attacker can traverse into an object's prototype chain. Successfully crafting a specific TOML document allows for the injection of arbitrary properties into Object.prototype, which then become visible to every object in the Node.js process.