CVE-2026-63386 is a vulnerability in the js-toml library, a TOML parser for JavaScript. The vulnerability occurs because the load() function does not bound nesting or dotted-key depth in the recursive parser, leading to a potential denial of service (DoS) attack. The issue is fixed in version 1.1.3. Affected systems should be assessed for exposure, and remediation should be prioritized. The vulnerability [truncated]
A vulnerability in the js-toml TOML parser for JavaScript, prior to version 1.1.2, allows for silent overwriting of values when duplicate keys are present, leading to potential type confusion and unexpected behavior in host applications. The vulnerability arises from the parser's incorrect handling of duplicate keys using `if (object[key])` instead of `if (key in object)`. This can result in structural ty [truncated]
