CVE-2026-50029: 
JavaScript vulnerability analysis and mitigation

CVE-2026-50029 is a silent type confusion vulnerability in the js-toml npm package, caused by an incorrect duplicate-key existence check in the TOML parser. The flaw allows attacker-controlled TOML input to silently overwrite falsy primitive values (false, 0, 0n, 0.0, -0, "") with truthy objects, violating the TOML 1.0.0 specification. It affects all versions of js-toml up to and including 1.1.1; version 1.1.2 contains the fix. The vulnerability was first published on May 28, 2026, and added to the GitHub Advisory Database on June 26, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an incorrect comparison (CWE-697) in src/load/interpreter.ts at two locations: Interpreter.tryCreatingObject (line 214) uses if (object[key]) instead of if (key in object), and Interpreter.getOrCreateArray (line 278) uses if (object[first] && ...) instead of if (first in object && ...). Because JavaScript evaluates falsy primitives as false in a boolean context, the duplicate-key detection branch is skipped when the existing value is false, 0, 0n, or "", and the parser silently overwrites it with a new sub-table or array-of-tables object. The bug is reachable via all three interpreter paths: assignValue (dotted keys), createTable ([stdTable] headers), and getOrCreateArray ([[arrayOfTables]] headers). A public proof-of-concept is included in the advisory (GitHub Advisory, js-toml Advisory).

Successful exploitation causes structural type confusion: a boolean false or numeric 0 value in a parsed configuration object is silently replaced by a truthy plain object. Applications that gate security-sensitive behavior on checks such as if (config.isAdmin), if (!user.banned), if (config.allowDelete), or if (config.publicMode) will silently take the truthy branch, potentially granting unauthorized access or bypassing access controls. There is no confidentiality or availability impact; the primary risk is integrity loss through unauthorized privilege escalation within the application's logic (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating that a crafted TOML document can bypass admin checks with no authentication or user interaction required. The CVE status is currently "Reserved" and there is no evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing at this time. No EPSS score is currently published. Exploitation requires that an attacker control or influence TOML input parsed by the vulnerable library (GitHub Advisory).

1. Identify target: Locate an application that uses js-toml <= 1.1.1 to parse TOML configuration or user-supplied input, and gates security-sensitive behavior on a boolean or numeric flag (e.g., isAdmin, banned, allowDelete).
2. Craft malicious TOML: Construct a TOML document that first defines the target key with a falsy primitive, then redefines it as a sub-table:

isAdmin = false
[isAdmin]
forced = "yes"

3. Deliver the payload: Supply the crafted TOML to the application through any input channel that feeds into js-toml's load() function (e.g., a configuration file upload, API endpoint, or user-editable settings).
4. Trigger type confusion: The parser skips duplicate-key detection because if (object['isAdmin']) evaluates false as falsy, overwrites the value with { forced: 'yes' }, and returns a truthy object.
5. Bypass security gate: The application evaluates if (config.isAdmin) as true, granting the attacker access to admin-only code paths or elevated privileges (GitHub Advisory, js-toml Advisory).

• Application Logs: Unexpected access to admin-only or privileged application features by users who should be restricted; authorization decisions that contradict stored user roles or configuration flags.
• TOML Input: Parsed TOML documents containing a key defined first as a falsy primitive (false, 0, "") and then redefined as a [table] or [[array of tables]] with the same name — this is spec-invalid and should never appear in legitimate input.
• Runtime Behavior: JSON.stringify() output of parsed config objects showing a key expected to be a boolean or number instead containing a nested object (e.g., {"isAdmin":{"forced":"yes"}}).

Upgrade js-toml to version 1.1.2, which replaces the incorrect if (object[key]) checks with if (key in object) in both affected locations in src/load/interpreter.ts. No configuration-based workaround is available; the fix must be applied at the library level. As an interim measure, applications should validate parsed TOML output to ensure security-critical flags are of the expected primitive type before using them in access-control decisions (GitHub Advisory).