Is CVE-2026-114142 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114142 being exploited in the wild.

How severe is CVE-2026-114142?

High severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

BinaryMuse Toml-Node before 5.0.1; tome (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.

Is there a fix for CVE-2026-114142?

Yes. tome (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114142 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114142?

Check whether you run BinaryMuse Toml-Node or tome (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114142: toml-node TOML parser prototype pollution in quoteDottedString

Q: Is there a fix for CVE-2026-114142?

Yes. tome (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114142 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114142?

Check whether you run BinaryMuse Toml-Node or tome (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114142 · Severity: high · CVSS 4 · Published 2026-10-21

toml-node is a TOML configuration file parser used in Node.js and browser applications. A flaw in the parser's handling of quoted keys allows an attacker to inject malicious properties into Object.prototype through specially crafted TOML input, potentially poisoning all objects created by the application and leading to unexpected behavior or code execution.

Technologies: BinaryMuse Toml-Node. Vendors: BinaryMuse, npm.

Quick answers

Is CVE-2026-114142 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114142 being exploited in the wild.
How severe is CVE-2026-114142?: High severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: BinaryMuse Toml-Node before 5.0.1; tome (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.
Is there a fix for CVE-2026-114142?: Yes. tome (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114142 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114142?: Check whether you run BinaryMuse Toml-Node or tome (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tome (npm): upgrade to 5.0.1 or later
```
npm install tome@5.0.1
```

Technical details

The vulnerability is a prototype pollution flaw in the quoteDottedString() function within lib/compiler.js. Distinct quoted key paths can render to the same internal string, allowing the addTableArray() function to incorrectly clear guards on unrelated keys. The assign() path then descends through unowned Date values without proper validation, reaching the prototype chain. An attacker can craft TOML input to inject properties into Object.prototype when parsed by toml.parse().

Affected products

BinaryMuse toml-node before 5.0.1

Identifiers

CVE-2026-114142
GHSA-h895-cgqg-jf52

Timeline

2026-10-21: disclosed: CVE-2026-114142 published on NVD
2026-10-12: patched: Fix committed and released in version 5.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.