CVE-2026-63386

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

EUVD-2026-84801

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-63386 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-63386 Source advisory: MEND:CVE-2026-63386...

CVE-2026-63386

The js-toml JavaScript TOML parser is vulnerable to a denial of service (DoS) due to uncontrolled recursion in the load() function. In versions prior to 1.1.3 , the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts fail to bound the nesting depth of arrays, inl...

CVE-2026-63386

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386: Uncontrolled Recursion

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

PT-2026-96973

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.3 Description The load function fails to limit nesting or dotted-key depth within the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts. Consequently, processing deeply nested...

CVE-2026-50029

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with "if objectkey" instead of "if key in object". When the prior value is a falsy primitive — "false", "0", "0n", "0.0", "-0", or """" — the...

EUVD-2026-58791

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029

Affects js-toml prior to 1.1.2. The parser uses if (object[key]) to decide duplicates, causing falsy primitives (false, 0, 0n, 0.0, -0, "") to be overwritten by later keys; this yields structural type confusion in load() output (e.g., isAdmin becomes truthy object). MITRE/ATT&CK not specified in ...

@astar-network/swanky-cli (>=2.2.0-alpha.0, <=2.2.3), @neon.id/uji-grader (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-50029 via js-toml (>=0.1.1, <=1.1.0)

js-toml NPM version =0.1.1, =2.2.0-alpha.0, =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-50029 Source advisory: MEND:CVE-2026-50029...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029: Incorrect Comparison

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...