Skip to content
Threat Feed
Subscribe

Product

Toml (< 4.1.2)

1 brief RSS
high advisory

Prototype Pollution in toml Node.js Package via Path Desynchronization

The toml Node.js package contains a prototype pollution vulnerability (CVE-2026-63376) that allows attackers to corrupt Object.prototype via __proto__ path manipulation and path-format desynchronization, potentially leading to RCE.

toml prototype-pollution supply-chain nodejs
1t 1c