npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype vulnerability discovered by ? in WordPress npm tome versions = 5.0.0...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

EUVD-2026-107553

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype...

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

EUVD-2026-107552

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse...

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

EUVD-2026-107555

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse...

EUVD-2026-107556

toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse...

npm: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

npm: toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

Linux Distros Unpatched Vulnerability : CVE-2026-114144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from...

Linux Distros Unpatched Vulnerability : CVE-2026-114141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete...

CVE-2026-114141

A flaw was found in toml. A remote attacker can trigger a Denial of Service DoS by supplying a crafted TOML document containing a large number of array-of-tables headers. Processing these unpruned headers causes repetitive path scanning that blocks the event loop, rendering the application...

CVE-2026-114143

A flaw was found in toml-node. A remote attacker could cause a Denial of Service DoS by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse can write attacker-controlled properties to Object.prototype because quoteDottedString in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray to clear another...

CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

CVE-2026-114141

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...