Prototype Pollution in toml-node Allows Remote Object Corruption
A flaw in toml-node before 5.0.1 lets attackers inject properties into Object.prototype, risking data corruption across Node.js applications.
Key points
- CVE-2026-114142 is rated 8.8 High severity by the NVD.
- The bug allows writing attacker-controlled properties to Object.prototype.
- Version 5.0.1 fixes the issue by correcting key path handling.
The toml-node library contains a prototype pollution vulnerability that can corrupt application state. Developers using versions prior to 5.0.1 face risk of unexpected behavior in their Node.js environments.
What happened
The National Vulnerability Database records CVE-2026-114142 as a high-severity flaw in the toml-node package. This library serves as a TOML parser for Node.js and browser environments. The issue exists in all versions released before 5.0.1. The vulnerability stems from how the library handles specific input structures during parsing operations.
The root cause lies within the quoteDottedString function located in lib/compiler.js. This function generates identical bookkeeping strings for distinct quoted key paths. Consequently, the addTableArray function clears the guard for a different key entirely. This misalignment allows the assign function to traverse through an unowned Date value.
During this traversal, the code fails to apply the necessary owned-container check. This oversight permits the process to reach the prototype chain directly. As a result, attackers can write controlled properties to Object.prototype. Any objects created elsewhere in the process may then inherit these injected properties.
Why it matters
Prototype pollution attacks can fundamentally alter how JavaScript objects behave. When Object.prototype is modified, every object in the application inherits the new properties. This can lead to logic errors, crashes, or unauthorized data access. The impact depends on how the application uses the parsed TOML data.
BinaryMuse, the maintainer of toml-node, has addressed this issue. Version 5.0.1 includes the necessary fixes to prevent this chain of events. Applications not yet updated remain exposed to this specific vector. The flaw demonstrates how subtle parsing errors can escalate into severe security issues.
Developers relying on this library for configuration or data processing are at risk. If an attacker can control the TOML input, they can exploit this path. The NVD assigns a CVSS score of 8.8 to this vulnerability. This rating reflects the high potential for impact on confidentiality and integrity.
What to watch
- Review dependency trees for toml-node versions below 5.0.1.
- Monitor for unexpected property inheritance in application objects.
- Check for anomalous behavior in data processing pipelines.
- Verify that all instances have been updated to the patched version.
Signals worth monitoring
Teams usually detect prototype pollution through unexpected application behavior or crashes. Security operations should check logs for sudden changes in object properties. Look for alerts indicating unauthorized modifications to core JavaScript objects. Monitor for anomalies in data validation or serialization processes. Containment often involves restarting affected services to reset object states. Check whether input validation rules are bypassed by crafted payloads. Review network traffic for unusual data structures being sent to parsers.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: toml-node
- Audit your project dependencies to identify any use of toml-node.
- Upgrade to version 5.0.1 or later once the vendor provides an update.
- Implement strict input validation for all TOML data sources.
- Monitor application logs for signs of object property injection.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-114142?
The National Vulnerability Database rates this vulnerability as 8.8, which is classified as High severity.
Which versions of toml-node are affected?
All versions prior to 5.0.1 are affected by this prototype pollution vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in version 5.0.1 of the toml-node library.
