CVE-2026-63376

npm/toml CVE-2026-63376: high 8.2

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Action: Upgrade toml to 4.1.2 or later.

npm i toml@4.1.2

Affected

Fixed versions

Sources

• osv: GHSA-v5mp-jgw5-2x6j
• https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j
• https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44
• https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463
• https://github.com/BinaryMuse/toml-node

CVE-2026-63376 · published 2026-09-03T20:55:32Z · modified 2026-09-03T21:10:38.140499Z · JSON