js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Description

js-toml’s interpreter checks whether a key already exists in a parser-built container with if (object[key]) instead of if (key in object). When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name.

Recommendation

Update the js-toml package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-m34p-749j-x6m6
• CVE-2026-50029
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Handlebars.js has JavaScript Injection via AST Type Confusion - CVE-2026-33937
• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - CVE-2026-33938

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

js-toml