Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🔴 BinaryMuse toml-node, Prototype Pollution, #CVE-2026-63376 (Critical) -DC-Sep2026-2176 https://dailycve.com/binarymuse-toml-node-prototype-pollution-cve-2026-63376-critical-dc-sep2026-2176/
Post summary
The post announces a critical prototype‑pollution vulnerability (CVE‑2026‑63376) in BinaryMuse toml-node, but provides no additional technical details or patch information.
🚨High - toml-node Prototype Pollution via __proto__ Table Paths (CVE-2026-63376) toml-node's npm package "toml" desyncs path tracking when parsing crafted TOML table paths containing __proto__, bypassing duplicate-key guards and allowing writes into Number.prototype then Object.prototype. Polluted prototypes expose attacker-controlled properties process-wide, enabling DoS, auth/logic bypass, and potential RCE via gadgets. Normal TOML without __proto__ paths is not affected. 👉Affected: toml < 4.1.2 | Upgrade to 4.1.2
Post summary
The post highlights CVE-2026-63376 prototype pollution in toml-node, detailing the vulnerability and its impact, and it recommends upgrading to version 4.1.2 to mitigate the risk.