js-toml
npm3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting js-tomlpage 1 of 1
- CVE-2025-54803HIGHCVSS 7.5EG 7.5✓ Fixed in 1.0.22025-08-05
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype …
- CVE-2026-49293HIGHCVSS 7.5EG 7.5✓ Fixed in 1.1.12026-06-19
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accu…
- CVE-2026-50029MEDIUMCVSS 5.3EG 5.3✓ Fixed in 1.1.22026-06-26
js-toml has silent type confusion via falsy-primitive duplicate-key bypass ### Summary `js-toml`'s interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When …
Check whether js-toml is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for js-toml CVEs against the assets you own.
Start Free Scan →