CVE-2021-48012 in fast-toml
Summary
by MITRE • 10/13/2026
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in fast-toml versions through 0.5.4 represents a critical prototype pollution flaw that stems from the library's handling of TOML data structures during parsing operations. Prototype pollution is a specific class of security issue where an attacker can inject properties into JavaScript Object.prototype, thereby affecting all objects created within the application environment without needing to instantiate them directly. In this context, the vulnerability arises because the parser does not adequately sanitize or restrict keys that correspond to reserved prototype attributes such as _proto_, constructor, and prototype. When a TOML document contains table headers like [_proto_] or [constructor.prototype], or utilizes dotted key notation for properties named _proto_.x, the parsing logic inadvertently assigns these values directly to the global Object prototype rather than treating them as standard data fields within the parsed object structure.
From a technical perspective, this flaw allows attackers to manipulate the fundamental behavior of JavaScript objects by modifying their default property definitions. By injecting malicious payloads into the prototype chain, an attacker can alter how methods behave across the entire application runtime. For instance, if a critical function relies on Object.prototype.hasOwnProperty or similar checks that are overridden via pollution, the integrity of security controls and data validation logic is compromised. This mechanism effectively bypasses standard object isolation boundaries, enabling persistent state manipulation that survives subsequent garbage collection cycles unless explicitly cleaned up by the application code. The presence of such keys in TOML input triggers this behavior because the parser treats them as valid property paths to be merged into the resulting JavaScript object hierarchy without verifying if they conflict with existing prototype properties.
The operational impact of this vulnerability is severe, primarily manifesting as denial of service and potential authorization bypasses. Denial of service occurs when the pollution causes infinite loops or crashes in applications that iterate over object keys using methods like for...in loops, which enumerate inherited properties from the prototype chain. If an attacker pollutes Object.prototype with a non-enumerable property or one that triggers recursive serialization errors, it can destabilize the Node.js event loop and crash the server process. Furthermore, authorization bypass is possible if security middleware relies on checking specific object properties to determine user roles or permissions. By injecting these properties into every object instance via prototype pollution, an attacker might trick authentication logic into granting elevated privileges or accessing restricted resources without proper credentials, effectively breaking the trust model of the application.
To mitigate this risk, developers must upgrade fast-toml to a version that implements strict key sanitization and prevents assignment to reserved prototype attributes. It is essential to ensure that parsers do not merge user-supplied keys into Object.prototype by default or use safe object creation methods like Object.create(null) for intermediate parsing structures where appropriate. Additionally, input validation should be enforced at the entry point of TOML processing to reject any documents containing _proto_, constructor, or prototype as top-level table headers or key segments. Security teams should also consider implementing runtime monitoring tools that detect unexpected modifications to global prototypes and apply defense-in-depth strategies such as Content Security Policy configurations where applicable to limit the impact of client-side exploitation vectors if this library is used in browser environments.