IA Squad
SearchEN
js · js-tomlHeads-up

js-toml duplicate-key detection bypasses falsy values

js-toml's duplicate-key detection uses truthy checks (`if (object[key])`) instead of the `in` operator, allowing falsy primitives (`false`, `0`, `0n`, `0.

27 Jun 2026Read 1 minSeverity: schedule it

What changed

js-toml's duplicate-key detection uses truthy checks (`if (object[key])`) instead of the `in` operator, allowing falsy primitives (`false`, `0`, `0n`, `0.0`, `-0`, `""`) to be silently overwritten by later sub-tables, dotted-key sub-tables, or array-of-tables. This violates the TOML 1.0.0 spec and causes structural type confusion.

Who it affects

All users of js-toml who parse TOML input that may contain duplicate keys with falsy initial values. Applications that rely on truthy checks of parsed values (e.g., `if (config.flag)`) are vulnerable to logic bypass.

What to do today

Update js-toml to a patched version once available, or apply the suggested fix in `src/load/interpreter.ts` by replacing `if (object[key])` with `if (key in object)` and `if (object[first] && !Array.isArray(object[first]))` with `if (first in object && !Array.isArray(object[first]))`.

The trail
Collected Audited Written Published