CVE-2026-63376

Received Received - Intake

Prototype Pollution in toml-node TOML Parser

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-63376

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

toml-node is a TOML parser for Node.js and the browser. Prior to version 4.1.2, the toml.parse() function in lib/compiler.js can be tricked by a table path like a.b.y.__proto__.__proto__. This allows an attacker to traverse from a scalar value into Number.prototype and Object.prototype. The issue arises because valueAssignments records paths as comma-joined strings while deepRef checks dot-joined paths, causing the duplicate-key guard to miss the attack. This enables writing attacker-controlled keys to Object.prototype.

Detection Guidance

This vulnerability affects the toml-node library in Node.js applications. To detect it, check if your project uses toml-node versions prior to 4.1.2 by inspecting package.json or running npm list toml-node. If vulnerable, update to version 4.1.2 or later immediately.

Impact Analysis

This vulnerability can lead to denial of service, logic or authorization bypass, or code execution in a Node.js process. If an application contains a suitable gadget, injected properties become visible throughout the process, potentially compromising the entire system.

Mitigation Strategies

Immediately update toml-node to version 4.1.2 or later. If updating is not possible, consider removing or replacing the library in your project. Review your application for potential gadgets that could be exploited via prototype pollution. Monitor for unusual behavior or crashes that may indicate exploitation.

Hi! I’m here to help you understand CVE-2026-63376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70