js-toml vulnerabilities
CVEs whose affected-version data names the js-toml package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-63386Medium· 5.3js-toml is a TOML parser for JavaScript
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply neste…
CVE-2026-50029Medium· 5.3js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`
js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy pri…
CVE-2026-49293High· 7.5js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals