## toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-114142
- 公開日時: 2026-10-22T16:39:55.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-h895-cgqg-jf52)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-h895-cgqg-jf52

影響: npm:tome <= 5.0.0 → 5.0.1
CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…