---
id: CVE-2026-114142
title: >-
  toml-node: Prototype pollution: parsing a TOML document can write to
  Object.prototype
summary: >-
  toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1,
  toml.parse() can write attacker-controlled properties to Object.prototype
  because quoteDottedString() in lib/compiler.js produces the same bookkeeping
  string for dis…
severity: high
cvss: 8.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-1321
vendor: BinaryMuse
product: toml-node
affected:
  - toml-node < 5.0.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-28T18:18:57.178068Z'
published: '2026-10-21'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:19:14.202Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114142'
references:
  - url: >-
      https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52
    label: >-
      https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52
  - url: >-
      https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
    label: >-
      https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
  - url: 'https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1'
    label: 'https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114142'
  - url: 'https://github.com/advisories/GHSA-h895-cgqg-jf52'
tags:
  - cve.org
  - ghsa
  - npm
epss: 0.00511
epssPercentile: 0.43694
aliases:
  - GHSA-h895-cgqg-jf52
ecosystem: npm
patched:
  - tome 5.0.1
ingestedAt: '2026-10-21T21:13:32.886Z'
---

## Overview

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.

## Affected

- `toml-node < 5.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-114142)

Affected packages:

- `tome <= 5.0.0`

Patched in:

- `tome 5.0.1`

Source: https://github.com/advisories/GHSA-h895-cgqg-jf52