EUVD-2026-48547

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

CVE-2026-16634 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

CVE-2026-16634

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

PT-2026-64273

Name of the Vulnerable Software and Affected Versions TOML::XS versions prior to 0.06 Description The software bundles an unsupported version of the tomlc99 library, which contains an uncontrolled recursion flaw. This occurs when the from toml function processes untrusted TOML data containing...

CVE-2025-55195

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution PP vulnerability. This is because the library is merging an untrusted object with an empt...

CVE-2025-55195 @std/toml Prototype Pollution in Node.js and Browser

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution PP vulnerability. This is because the library is merging an untrusted object with an empt...