toml
npm5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting tomlpage 1 of 1
- CVE-2026-114141HIGHCVSS 8.7EG 8.7fixed in 5.0.12026-10-21
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tab…
- CVE-2026-114143HIGHCVSS 8.7EG 8.7fixed in 5.0.12026-10-21
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-t…
- CVE-2026-114144HIGHCVSS 7.5EG 7.5fixed in 5.0.12026-10-21
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks w…
- CVE-2026-63376HIGHCVSS 8.2EG 8.2fixed in 4.1.22026-09-03
toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Obje…
- CVE-2026-77465HIGHCVSS 7.5EG 7.5fixed in 4.2.02026-09-03
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions rec…
Check whether toml is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for toml CVEs against the assets you own.
Book a Demo →