CVE-2026-63376

CVE-2026-63376 is a prototype pollution vulnerability (CWE-1321) in the npm 'toml' package (toml-node): toml.parse() writes attacker-controlled keys onto Object.prototype, corrupting every ordinary JavaScript object in the process. Although the compiler shields the tables it builds with Object.create(null), the deepRef path resolver fails to reject descent through an existing scalar value because its duplicate-key tracking strings desynchronize from the keys actually used during traversal; a crafted table header such as [a.b.y.__proto__.__proto__] (where a.b.y = 1) therefore walks the native prototype chain onto Object.prototype, after which all subsequent key/value pairs pollute it, including injection of nested gadget objects. An attacker who can get malicious TOML parsed by a server or application gains arbitrary global property injection — high integrity impact per the CVSS 3.1 score of 8.2 — which can alter program logic via polluted properties or gadgets and cause availability loss, with no confidentiality impact. Any Node.js project that parses untrusted or semi-trusted TOML with this package is exposed; version 4.1.1, the latest at the time of disclosure, is vulnerable, and the source data identifies no fixed version or affected range. No exploitation in the wild is known (absent from CISA KEV, EPSS about 0.4% at the 32nd percentile), and no public proof of concept is tracked beyond the reproduction steps in the advisory.

What to do: Audit your dependency tree for npm 'toml' (e.g., npm ls toml) and determine whether any service parses attacker-supplied TOML with it; upgrade to a patched release when one is published, verifying against the npm security advisory since no fixed version is named in the source data. Until patched, avoid parsing untrusted TOML with toml.parse(), reject or sanitize table headers and dotted keys containing __proto__ segments before parsing, and consider freezing Object.prototype as defense-in-depth. Watch downstream services for pollution symptoms such as unexpected inherited properties, logic anomalies, or crashes.