CVE-2026-63376: Prototype Pollution via Path Desynchronization in toml-node
Vulnerability ID: CVE-2026-63376
CVSS Score: 8.2
Published: 2026-09-03
A prototype pollution vulnerability exists in the toml-node library (by BinaryMuse) in versions prior to 4.1.2. The flaw arises from inconsistent internal tracking of parsed paths (comma-joined vs. dot-joined serialization) combined with lack of object ownership validation during recursive dictionary descent (scalar descent). This allows unauthenticated remote attackers to modify base object structures by crafting malicious TOML documents containing conflicting duplicate table paths or nested references.
TL;DR
Improper key verification and unrestricted recursive object traversal in toml-node's compiler logic allow remote attackers to poison Object.prototype via crafted TOML input, enabling prototype pollution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1321
- Attack Vector: Network (Unauthenticated)
- CVSS v3.1 Score: 8.2 (High)
- Exploit Status: Proof of Concept (PoC) available
- KEV Status: Not Listed
- EPSS Score: 0.00383
- Impact Category: Integrity (High), Availability (Low)
Affected Systems
- Applications utilizing toml-node for parsing untrusted user configuration files
- Node.js server-side platforms processing TOML structures under versions < 4.1.2
-
toml-node: < 4.1.2 (Fixed in:
4.1.2)
Code Analysis
Commit: def6ab5
Fix prototype pollution vulnerability by introducing strict WeakSet ownership and standardizing compiler paths
Commit: dfaff66
Integrate comprehensive unit tests for prototype pollution scenarios in compilation suites
Exploit Details
- GitHub Security Advisory: Advisory documenting official reproduction cases and vulnerable compiler mechanisms
Mitigation Strategies
- Upgrade to toml-node v4.1.2 or higher
- Launch NodeJS with the --disable-proto=delete CLI flag
- Freeze Object.prototype using Object.freeze() at application startup
- Implement structural validation or schema verification on incoming configuration payloads
Remediation Steps:
- Execute the package manager update command: npm install toml-node@4.1.2
- Locate NodeJS execution scripts and append --disable-proto=delete to production execution environments
- Verify that dependencies do not rely on dynamic prototype additions that could break after freezing prototypes
- Deploy unit tests targeting recursive TOML structures to guarantee parsing libraries reject malicious inputs
References
- NVD Vulnerability Details: CVE-2026-63376
- CVE-2026-63376 Record at CVE.org
- GHSA-v5mp-jgw5-2x6j GitHub Advisory
- OSV / CVE Project Vulnerability Data JSON File
Read the full report for CVE-2026-63376 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)