CVE-2026-114142

What it actually does

toml.parse() performs prototype pollution by treating distinct quoted dotted key paths as identical bookkeeping strings, allowing addTableArray() to bypass guard checks; subsequent assign() descent through an unowned Date object reaches Object.prototype and injects attacker-controlled properties that affect objects created elsewhere in the process.

Why it matters to the business

Applications relying on the parser can experience unpredictable object behavior, property injection leading to logic bypasses, denial of service, or escalation to higher-severity issues in downstream code that consumes the resulting objects.

How an attack unfolds

An attacker supplies a crafted TOML document containing specially quoted dotted keys that collide in quoteDottedString(); the parser's table-array handling clears an unrelated guard, the assign path skips the owned-container check, and the resulting polluted property is inherited by other objects created after parsing.

How to fix it

Upgrade toml-node to version 5.0.1 or later; after upgrade, re-test all TOML parsing code paths with both benign and adversarial inputs containing quoted dotted keys.

How to confirm the fix worked

Confirm package version is at least 5.0.1; run parser against known-colliding quoted-key test vectors and verify no properties appear on Object.prototype; monitor for any post-parse object mutation side effects.

Typical attack path

1. Attacker crafts TOML payload with colliding quoted dotted key paths
2. Victim application calls toml.parse() on attacker-controlled input
3. quoteDottedString() produces identical bookkeeping for distinct paths
4. addTableArray() clears guard for another key
5. assign() descends through unowned Date and reaches Object.prototype
6. Injected property becomes visible on unrelated objects created later

How to detect it

Search application logs for unusual property names appearing on parsed configuration objects; look for process crashes or unexpected behavior immediately after TOML parsing of external input; review any recent changes that began consuming untrusted TOML.

What your security team should do

• Immediately upgrade all instances to 5.0.1
• Add automated dependency scanning for toml-node in CI pipelines
• Review any application code that passes untrusted data to toml.parse()
• Implement input validation or schema enforcement before parsing