CVE-2021-48012

Received Received - Intake

Prototype Pollution in fast-toml Library

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2021-48012

Affected Vendors & Products

Vendor	Product	Version / Range
Gin-Quin	fast-toml	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability is a prototype pollution issue in the fast-toml library through version 0.5.4. Attackers can exploit it by supplying TOML data containing special keys like __proto__, constructor, or prototype. These keys allow modifying Object.prototype, which affects all objects in the application. This can lead to denial of service or authorization bypass by altering object behavior.

Detection Guidance

To detect this vulnerability, inspect applications using fast-toml versions prior to 0.5.4 for TOML parsing. Check for unexpected modifications to Object.prototype or prototype pollution patterns in TOML files. Review logs for crashes or authorization bypasses after TOML parsing.

Impact Analysis

If you use the vulnerable fast-toml library, attackers could exploit this to pollute prototypes, causing crashes or unexpected behavior in your application. This may result in denial of service or allow unauthorized access by bypassing security checks. The impact depends on how the library is used in your system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling authorization bypass through prototype pollution. Attackers could manipulate object properties to gain unauthorized access to sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update fast-toml to version 0.5.4 or later. If updating is not possible, replace fast-toml with a secure TOML parser that does not allow prototype pollution. Audit all TOML inputs for malicious keys like __proto__, constructor, or prototype.

Hi! I’m here to help you understand CVE-2021-48012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70