js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Description

js-toml’s interpreter checks whether a key already exists in a parser-built container with if (object[key]) instead of if (key in object). When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name.

Recommendation

Update the js-toml package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-m34p-749j-x6m6
• CVE-2026-50029
• CWE-697
• CAPEC-310
• OWASP 2021-A6