npm/js-toml CVE-2026-50029: medium 5.3, EPSS 0.40%

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Action: Upgrade js-toml to 1.1.2 or later.

npm i js-toml@1.1.2

Affected

Fixed versions

Sources

• osv: GHSA-m34p-749j-x6m6
• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6
• https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb
• https://github.com/sunnyadn/js-toml
• https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2

CVE-2026-50029 · published 2026-06-26T22:49:28Z · modified 2026-07-21T17:30:26.096074019Z · JSON