ROOT-APP-NPM-CVE-2026-114141 CVE-2026-114141 in toml - Patched by Root

Root has patched CVE-2026-114141 in the toml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-77465 CVE-2026-77465 in toml - Patched by Root

Root has patched CVE-2026-77465 in the toml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-114144 CVE-2026-114144 in toml - Patched by Root

Root has patched CVE-2026-114144 in the toml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root

Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...

CLSA-2026-1793099990 TuxCare security update for toml (3 CVEs)

TuxCare rebuilt toml to address 3 CVEs. Fixed in 4.3.0-tuxcare.1...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

EUVD-2026-107553

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype...

npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype vulnerability discovered by ? in WordPress npm tome versions = 5.0.0...

@zone-eu/kirin-plugin-wildduck (0.1.2), @zone-eu/wild-config (>=1.7.6, <=1.7.7) +7 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/kirin-plugin-wildduck 0.1.2 - @zone-eu/wild-config =1.7.6, =1.49.6, =3.11.0, =1.32.32, =2.13.0, =2.73.0, =6.0.4, =1.1.7, =2.0.0 Source cves:...

@zone-eu/kirin-plugin-wildduck (0.1.2), @zone-eu/wild-config (>=1.7.6, <=1.7.7) +7 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/kirin-plugin-wildduck 0.1.2 - @zone-eu/wild-config =1.7.6, =1.49.6, =3.11.0, =1.32.32, =2.13.0, =2.73.0, =6.0.4, =1.1.7, =2.0.0 Source cves:...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via ambiguous path-key encoding in lib/compiler.js, where the compiler tracked table origins using string-rendered path sets rather than per-object tags. Because quoteDottedString quotes a segment only when it contai...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via ambiguous path-key encoding in lib/compiler.js, where the compiler tracked table origins using string-rendered path sets rather than per-object tags. Because quoteDottedString quotes a segment only when it contai...

@zone-eu/kirin-plugin-wildduck (0.1.2), @zone-eu/wild-config (>=1.7.6, <=1.7.7) +7 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/kirin-plugin-wildduck 0.1.2 - @zone-eu/wild-config =1.7.6, =1.49.6, =3.11.0, =1.32.32, =2.13.0, =2.73.0, =6.0.4, =1.1.7, =2.0.0 Source cves:...

@zone-eu/kirin-plugin-wildduck (0.1.2), @zone-eu/wild-config (>=1.7.6, <=1.7.7) +7 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/kirin-plugin-wildduck 0.1.2 - @zone-eu/wild-config =1.7.6, =1.49.6, =3.11.0, =1.32.32, =2.13.0, =2.73.0, =6.0.4, =1.1.7, =2.0.0 Source cves:...

EUVD-2026-107552

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse...

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

@zone-eu/kirin-plugin-wildduck (0.1.2), @zone-eu/wild-config (>=1.7.6, <=1.7.7) +7 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/kirin-plugin-wildduck 0.1.2 - @zone-eu/wild-config =1.7.6, =1.49.6, =3.11.0, =1.32.32, =2.13.0, =2.73.0, =6.0.4, =1.1.7, =2.0.0 Source cves:...

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

GHSA-4QX8-W7C3-PJ3P toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...