Fast-Toml (<= 0.5.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fast-toml--0.5.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 22:40:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrototype Pollution Vulnerability in fast-tomlhttps://feed.craftedsignal.io/briefs/2026-10-fast-toml-prototype-pollution/Mon, 12 Oct 2026 22:40:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-fast-toml-prototype-pollution/The fast-toml library up to version 0.5.4 is vulnerable to prototype pollution, allowing attackers to modify Object.prototype through crafted TOML input, potentially leading to denial of service or authorization bypass.The fast-toml library (all versions through 0.5.4) contains a prototype pollution vulnerability that allows attackers to manipulate the base Object.prototype. By supplying TOML data containing specific key segments such as "proto", "constructor", or "prototype", an attacker can influence the behavior of all objects within the JavaScript runtime. Specifically, passing "[proto]" or "[constructor.prototype]" as table headers, or using "proto.x" as dotted keys during the parse() process, triggers the vulnerability. This flaw poses a significant risk to applications that process untrusted TOML data, as it can be leveraged to achieve authorization bypass or cause denial of service conditions by disrupting expected object properties.

Impact

Successful exploitation allows for the modification of the global Object.prototype, which can cause downstream application logic errors, denial of service, or authorization bypasses in environments utilizing fast-toml to process external or untrusted data. There is no specific victim sector reported, but any node-based application relying on this dependency for configuration or data parsing is at risk.

Recommendation

Prioritized actions for development and security engineering teams:

  • Identify all instances of the fast-toml dependency within the software bill of materials (SBOM) and update to a version beyond 0.5.4 if a patch is available.
  • Implement input validation on all TOML data processed by the application to explicitly reject keys containing "proto", "constructor", or "prototype".
  • Perform dependency auditing to determine if fast-toml is included as a transitive dependency in other packages.
]]>highadvisoryprototype-pollutionsupply-chainvulnerability