EUVD-2026-48547

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

CVE-2026-16634 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

CVE-2026-16634

CVE-2026-16634 affects TOML::XS versions before 0.06 for Perl, which bundles an outdated and vulnerable tomlc99 library. The underlying issue is an uncontrolled recursion in tomlc99 that can cause a stack overflow when processing deeply nested or untrusted TOML via from_toml. The implicated mitig...

PT-2026-64273

Name of the Vulnerable Software and Affected Versions TOML::XS versions prior to 0.06 Description The software bundles an unsupported version of the tomlc99 library, which contains an uncontrolled recursion flaw. This occurs when the from toml function processes untrusted TOML data containing...

CVE-2025-55195

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution PP vulnerability. This is because the library is merging an untrusted object with an empt...

CVE-2025-55195 @std/toml Prototype Pollution in Node.js and Browser

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution PP vulnerability. This is because the library is merging an untrusted object with an empt...