CVE-2026-50029
Received Received - Intake

js-toml TOML Parser Duplicate Key Overwrite Vulnerability

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `""` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You cannot define any key or table more than once"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-50029
EUVD
EUVD-2026-58791

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sunnyadn js-toml to 1.1.2 (exc)
sunnyadn js-toml 1.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the js-toml library, a TOML parser for JavaScript. The issue occurs because the parser uses a truthy check (`if (object[key])`) instead of a proper key existence check (`if (key in object)`) to detect duplicate keys. This allows falsy primitives like `false`, `0`, or empty strings to be silently overwritten by subsequent TOML structures with the same name, violating the TOML 1.0.0 specification which requires duplicate keys to raise a parse error.

Detection Guidance

To detect this vulnerability, inspect applications using js-toml versions 1.1.1 or earlier. Check for TOML files that may contain duplicate keys with falsy values (false, 0, empty strings) followed by sub-tables or arrays. Use commands like 'npm list js-toml' to check installed versions. Review application logs for unexpected type conversions or parse errors during TOML parsing.

Impact Analysis

This vulnerability can lead to unexpected behavior in applications using affected versions of js-toml. For example, a boolean `false` value might be replaced with an object, causing conditions like `if (config.flag)` to evaluate as truthy. This could allow attackers to bypass security checks or manipulate application logic through maliciously crafted TOML files.

Mitigation Strategies

Immediately upgrade js-toml to version 1.1.2 or later. Update dependencies in package.json and run 'npm update js-toml'. If using a lockfile, regenerate it. Audit all TOML files for duplicate keys with falsy values to ensure they trigger parse errors as per TOML 1.0.0 spec. Test applications thoroughly after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart