CVE-2026-63376High· 8.2▾ Twilighttoml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Ob…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
8.2 → 3.7
high → low
3.7 → 8.2
low → high
8.2 → 3.7
high → low
3.7 → 8.2
low → high
8.2 → 3.7
high → low
3.7 → 8.2
low → high
toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same proto traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
toml < 4.1.2Patched in:
toml 4.1.2Source: https://github.com/advisories/GHSA-v5mp-jgw5-2x6j
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77465High· 7.5toml-node is a TOML parser for Node.js and the browser
CVE-2026-5038High· 7.5multer: Multer: Denial of Service via aborted or malformed multipart uploads (CVE-2026-5038)
CVE-2026-80997Medium· 5.5kernel: net: ipa: fix stalled modem TX queue after runtime resume (CVE-2026-80997)
CVE-2026-89500High· 7.0kernel: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)
CVE-2026-89503Medium· 5.5kernel: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503)
CVE-2026-89570High· 7.0kernel: cxl/mce: Make the MCE notifier per-region (CVE-2026-89570)