Junglewise Threat Intelligence

CVE-2026-63376: npm toml prototype pollution via __proto__ desynchronization

CVE-2026-63376 · Severity: high · CVSS 8.2 · Published 2026-09-03

Executive brief

The TOML parser used by 14.8 million weekly Node.js applications can be tricked into corrupting JavaScript's Object.prototype when parsing attacker-controlled configuration or package metadata. This allows an attacker to inject malicious properties that affect every object in the entire application process, leading to application crashes, data manipulation, or remote code execution depending on how the app uses those objects.

Technical details

A prototype pollution vulnerability exists in toml.parse() due to two compounding defects in the compiler's path-tracking logic. First, the deepRef function treats __proto__, constructor, and prototype as ordinary object keys without validation, allowing traversal through scalar values (e.g., a number) into the actual JavaScript prototype chain. Second, a type desynchronization in path recording—where currentPath alternates between array and string types—causes the path validation guard to build mismatched strings ("a.b.y" vs "a,b.y"), causing duplicate-key checks to fail silently. An attacker can route a TOML table path through a scalar value and into Object.prototype (e.g., [a.b.y.__proto__.__proto__]), injecting arbitrary properties visible to all objects in the process. No authentication or user interaction is required; any application parsing untrusted TOML is vulnerable.

Affected products

  • BinaryMuse toml < 4.1.2

Timeline

  • 2026-07-01: disclosed: Published by GitHub
  • 2026-09-03: patched: Version 4.1.2 released with fix
  • 2026-09-03: advisory: Official GitHub Advisory GHSA-v5mp-jgw5-2x6j published

References

Related threats