CVE-2026-114142

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries. ### Details Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0. **1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment: ```js 287: function quoteDottedString(str) { 288: if (str.indexOf(".") > -1) { 289: return "\"" + str + "\""; 290: } else { 291: return str; 292: } 293: } ``` So the key path `['x.y']` and the key path `['"x', 'y"']` both render as the string `"x.y"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot. **2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry. **3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test: ```js 93: target = target[k]; ... 103: target[lastKey] = reduced; ``` A TOML datetime is a `Date`. It satisfies `typeof target[k] === "object"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`. Putting the three together, a document can m