Skip to content
OpenAdvisories

Package · npm

js-toml

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2026-50029

    js-toml has silent type confusion via falsy-primitive duplicate-key bypass

    js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`,…

    sunnyadn js-toml js-toml npm
  • High 7.5
    CVE-2026-49293

    CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

    js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.1 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accumulator by the radix…

    sunnyadn js-toml js-toml npm
  • High 7.9
    CVE-2025-54803

    js-toml is vulnerable to Prototype Pollution

    js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a malicio…

    sunnyadn js-toml js-toml npm