CVE-2026-50029: sunnyadn js-toml type confusion via duplicate-key bypass

CVE-2026-50029 · Severity: medium · CVSS 5.3 · Published 2026-08-14

js-toml is a library used to parse TOML configuration files. A flaw in how it handles duplicate keys allows an attacker to bypass security checks by overwriting configuration values. For example, an attacker could change a 'false' security flag to a 'true' object, potentially gaining unauthorized access to administrative features or bypassing banned user restrictions.

Technologies: js-toml (npm), Sunnyadn Js-Toml. Vendors: npm, Sunnyadn.

Quick answers

Is CVE-2026-50029 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50029 being exploited in the wild.
How severe is CVE-2026-50029?
Medium severity, with a CVSS score of 5.3, published 14 August 2026.
Which products and versions are affected?
js-toml (npm) SEMVER:introduced=0,fixed=1.1.2; Sunnyadn Js-Toml <= 1.1.1.
Is there a fix for CVE-2026-50029?
Yes. js-toml (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50029 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50029?
Check whether you run js-toml (npm) or Sunnyadn Js-Toml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • js-toml (npm): upgrade to 1.1.2 or later
    npm install js-toml@1.1.2

Technical details

The js-toml interpreter contains a logic error in its duplicate-key detection state machine. It uses truthy checks (e.g., `if (object[key])`) instead of the `in` operator to verify if a key has already been defined. When a key is initially assigned a 'falsy' primitive value (such as `false`, `0`, or `""`), the check fails, allowing the key to be silently overwritten by a subsequent sub-table or array-of-tables. This results in structural type confusion where a boolean or numeric value is replaced by a truthy object. This vulnerability is reachable via dotted keys, standard table headers, and array-of-tables headers. The issue is fixed in version 1.1.2.

Affected products

  • sunnyadn js-toml <= 1.1.1

Identifiers

  • CVE-2026-50029
  • GHSA-m34p-749j-x6m6

Timeline

  • 2026-05-28: disclosed
  • 2026-06-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.