CVE-2026-63376: npm toml prototype pollution via __proto__ desynchronization

CVE-2026-63376 · Severity: high · CVSS 8.2 · Published 2026-09-03

The TOML parser used by 14.8 million weekly Node.js applications can be tricked into corrupting JavaScript's Object.prototype when parsing attacker-controlled configuration or package metadata. This allows an attacker to inject malicious properties that affect every object in the entire application process, leading to application crashes, data manipulation, or remote code execution depending on how the app uses those objects.

Technologies: toml (npm). Vendors: npm.

Quick answers

Is CVE-2026-63376 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63376 being exploited in the wild.
How severe is CVE-2026-63376?
High severity, with a CVSS score of 8.2, published 3 September 2026.
Which products and versions are affected?
toml (npm) < 4.1.2, SEMVER:introduced=0,fixed=4.1.2.
Is there a fix for CVE-2026-63376?
Yes. toml (npm): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63376 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63376?
Check whether you run toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • toml (npm): upgrade to 4.1.2 or later
    npm install toml@4.1.2

Technical details

A prototype pollution vulnerability exists in toml.parse() due to two compounding defects in the compiler's path-tracking logic. First, the deepRef function treats __proto__, constructor, and prototype as ordinary object keys without validation, allowing traversal through scalar values (e.g., a number) into the actual JavaScript prototype chain. Second, a type desynchronization in path recording—where currentPath alternates between array and string types—causes the path validation guard to build mismatched strings ("a.b.y" vs "a,b.y"), causing duplicate-key checks to fail silently. An attacker can route a TOML table path through a scalar value and into Object.prototype (e.g., [a.b.y.__proto__.__proto__]), injecting arbitrary properties visible to all objects in the process. No authentication or user interaction is required; any application parsing untrusted TOML is vulnerable.

Affected products

  • BinaryMuse toml < 4.1.2

Identifiers

  • CVE-2026-63376
  • GHSA-v5mp-jgw5-2x6j

Timeline

  • 2026-07-01: disclosed: Published by GitHub
  • 2026-09-03: patched: Version 4.1.2 released with fix
  • 2026-09-03: advisory: Official GitHub Advisory GHSA-v5mp-jgw5-2x6j published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.