CVE-2026-50029: js-toml Silent Type Confusion Vulnerability
Summary
CVE-2026-50029: js-toml has silent type confusion via falsy-primitive duplicate-key bypass. Affects js-toml versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
js-toml is a JavaScript library used for parsing TOML (Tom's Obvious, Minimal Language) configuration files. It allows developers to easily read and manipulate configuration data in a structured format. The library is designed to be simple and efficient, but it has a critical vulnerability that can lead to unintended behavior when handling duplicate keys in TOML files.
Vulnerability Detail
The vulnerability arises from the way js-toml checks for existing keys in an object. Instead of using 'if (key in object)', it uses 'if (object[key])', which can lead to silent overwriting of values when the existing value is a falsy primitive (e.g., false, 0, or ''). This behavior violates the TOML specification, which states that defining a key multiple times is invalid. As a result, attackers can manipulate the configuration structure, leading to potential security risks, such as unauthorized access to admin functionalities.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
npm install js-toml@2.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.2
This is the first release that contains the fix.
npm install js-toml@1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, ensure that your TOML files do not contain duplicate keys, especially with falsy values. For example, avoid the following structure:
isAdmin = false
[isAdmin]
forced = "yes"
Instead, use unique keys to prevent this vulnerability from being exploited.
Conclusion
The js-toml library has a significant vulnerability (CVE-2026-50029) that can lead to silent type confusion due to improper key checks. It is crucial for developers using this library to update to version 1.1.2 or later to mitigate the risk of exploitation. Regular monitoring with tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for js-toml →
FAQ
The vulnerability can lead to structural type confusion, allowing attackers to bypass security checks and gain unauthorized access to sensitive functionalities.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json, Vulert can identify if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Yes, you can mitigate the risk by ensuring that your TOML files do not contain duplicate keys, especially those with falsy values.
You can find more information about js-toml on its GitHub repository, where you can also view the latest updates and issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-toml.
