{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afast-toml_projectfast-tomlnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fast-toml_project:fast-toml:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2021-48012"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fast-toml (\u003c= 0.5.4)"],"_cs_severities":["high"],"_cs_tags":["prototype-pollution","supply-chain","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe fast-toml library (all versions through 0.5.4) contains a prototype pollution vulnerability that allows attackers to manipulate the base Object.prototype. By supplying TOML data containing specific key segments such as \u0026quot;\u003cstrong\u003eproto\u003c/strong\u003e\u0026quot;, \u0026quot;constructor\u0026quot;, or \u0026quot;prototype\u0026quot;, an attacker can influence the behavior of all objects within the JavaScript runtime. Specifically, passing \u0026quot;[\u003cstrong\u003eproto\u003c/strong\u003e]\u0026quot; or \u0026quot;[constructor.prototype]\u0026quot; as table headers, or using \u0026quot;\u003cstrong\u003eproto\u003c/strong\u003e.x\u0026quot; as dotted keys during the parse() process, triggers the vulnerability. This flaw poses a significant risk to applications that process untrusted TOML data, as it can be leveraged to achieve authorization bypass or cause denial of service conditions by disrupting expected object properties.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the modification of the global Object.prototype, which can cause downstream application logic errors, denial of service, or authorization bypasses in environments utilizing fast-toml to process external or untrusted data. There is no specific victim sector reported, but any node-based application relying on this dependency for configuration or data parsing is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the fast-toml dependency within the software bill of materials (SBOM) and update to a version beyond 0.5.4 if a patch is available.\u003c/li\u003e\n\u003cli\u003eImplement input validation on all TOML data processed by the application to explicitly reject keys containing \u0026quot;\u003cstrong\u003eproto\u003c/strong\u003e\u0026quot;, \u0026quot;constructor\u0026quot;, or \u0026quot;prototype\u0026quot;.\u003c/li\u003e\n\u003cli\u003ePerform dependency auditing to determine if fast-toml is included as a transitive dependency in other packages.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:40:05Z","date_published":"2026-10-12T22:40:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fast-toml-prototype-pollution/","summary":"The fast-toml library up to version 0.5.4 is vulnerable to prototype pollution, allowing attackers to modify Object.prototype through crafted TOML input, potentially leading to denial of service or authorization bypass.","title":"Prototype Pollution Vulnerability in fast-toml","url":"https://feed.craftedsignal.io/briefs/2026-10-fast-toml-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fast-Toml_project:fast-Toml:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}