Skip to main content
cve.nowby Sazabi
← npm
npmPackage

js-toml

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.0.1 (Aug 4, 2026): no advisory affects it
Newest unaffected release
2.0.1 (Aug 4, 2026), the latest release
Advisories
3 · 2 high, 1 medium
Weekly downloads
41.5K
Dependents
3
Releases
15 since 0.1.0 (Nov 13, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-50029Medium 5.3

    js-toml has silent type confusion via falsy-primitive duplicate-key bypass

    Affected: fixed in 1.1.2.

    Fixed in 1.1.2 (released May 28, 2026, 78 days before disclosure).

    The latest release, 2.0.1, is not affected.

    43% of js-toml downloads last week were affected versions (18.9K).

  • CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

    Affected: fixed in 1.1.2.

    Fixed in 1.1.2 (released May 28, 2026, 22 days before disclosure).

    The latest release, 2.0.1, is not affected.

    43% of js-toml downloads last week were affected versions (18.9K).

  • js-toml is vulnerable to Prototype Pollution

    Affected: fixed in 1.0.2.

    Fixed in 1.0.2 (released Aug 3, 2025, 2 days before disclosure).

    The latest release, 2.0.1, is not affected.

    9.2% of js-toml downloads last week were affected versions (4K).