toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

影響: npm:tome <= 5.0.0 → 5.0.1

CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…

Read on GitHub Advisory Database

On 10/23/2026, 01:39 AM, GitHub Advisory Database published "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-114142.