# CVE-2026-50029: sunnyadn js-toml type confusion via duplicate-key bypass

Source: https://junglewise.ai/threats/cve-2026-50029-sunnyadn-js-toml-type-confusion-via-duplicate-key-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-50029 · Severity: medium · CVSS 5.3 · Published 2026-08-14

js-toml is a library used to parse TOML configuration files. A flaw in how it handles duplicate keys allows an attacker to bypass security checks by overwriting configuration values. For example, an attacker could change a 'false' security flag to a 'true' object, potentially gaining unauthorized access to administrative features or bypassing banned user restrictions.

Technologies: [js-toml (npm)](https://junglewise.ai/threats/technologies/npm-js-toml), [Sunnyadn Js-Toml](https://junglewise.ai/threats/technologies/js-toml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Sunnyadn](https://junglewise.ai/threats/vendors/sunnyadn).

## Quick answers

**Is CVE-2026-50029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50029 being exploited in the wild.

**How severe is CVE-2026-50029?** Medium severity, with a CVSS score of 5.3, published 14 August 2026.

**Which products and versions are affected?** js-toml (npm) SEMVER:introduced=0,fixed=1.1.2; Sunnyadn Js-Toml <= 1.1.1.

**Is there a fix for CVE-2026-50029?** Yes. js-toml (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50029 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50029?** Check whether you run js-toml (npm) or Sunnyadn Js-Toml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- js-toml (npm): upgrade to 1.1.2 or later

  ```sh
  npm install js-toml@1.1.2
  ```


## Technical details

The js-toml interpreter contains a logic error in its duplicate-key detection state machine. It uses truthy checks (e.g., `if (object[key])`) instead of the `in` operator to verify if a key has already been defined. When a key is initially assigned a 'falsy' primitive value (such as `false`, `0`, or `""`), the check fails, allowing the key to be silently overwritten by a subsequent sub-table or array-of-tables. This results in structural type confusion where a boolean or numeric value is replaced by a truthy object. This vulnerability is reachable via dotted keys, standard table headers, and array-of-tables headers. The issue is fixed in version 1.1.2.

## Affected products

- sunnyadn js-toml <= 1.1.1

## Identifiers

- CVE-2026-50029
- GHSA-m34p-749j-x6m6

## Timeline

- 2026-05-28: disclosed
- 2026-06-26: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/CosmicCrusader23](https://api.github.com/users/CosmicCrusader23)
- [https://github.com/CosmicCrusader23](https://github.com/CosmicCrusader23)
- [https://api.github.com/users/CosmicCrusader23/gists%7B/gist_id%7D](https://api.github.com/users/CosmicCrusader23/gists%7B/gist_id%7D)
- [https://api.github.com/users/CosmicCrusader23/repos](https://api.github.com/users/CosmicCrusader23/repos)
- [https://avatars.githubusercontent.com/u/217740635?v=4](https://avatars.githubusercontent.com/u/217740635?v=4)
- [https://api.github.com/users/CosmicCrusader23/events%7B/privacy%7D](https://api.github.com/users/CosmicCrusader23/events%7B/privacy%7D)

## Related threats

- [js-toml stack exhaustion in recursive parser](https://junglewise.ai/threats/cve-2026-63386-js-toml-is-a-toml-parser-for-javascript-prior-to-1-1-3-load-does)
- [js-toml CPU exhaustion via O(n²) BigInt construction](https://junglewise.ai/threats/cve-2026-49293-js-toml-cpu-exhaustion-via-o-n-bigint-construction)
- [js-toml prototype pollution via malicious TOML](https://junglewise.ai/threats/cve-2025-54803-js-toml-prototype-pollution-via-malicious-toml)