The js-toml JavaScript TOML parser before version 1.1.2 uses an incorrect comparison (`if (object[key])`) to detect duplicate keys instead of the correct `if (key in object)`. This causes keys with falsy primitive values (false, 0, 0n, 0.0, -0, or empty string) to be treated as non-existent, allowing later sub-tables or arrays with the same key to overwrite them silently. According to the TOML 1.0.0 specification, defining a key multiple times is invalid and should result in a parse error. The flaw leads to structural type confusion where a boolean false or numeric zero is replaced by a truthy object, potentially causing host applications to incorrectly take truthy branches in conditional logic. This vulnerability is distinct from a prior prototype pollution fix and does not involve Object.prototype pollution. The issue is fixed in version 1.1.2 by correcting the duplicate-key detection logic.

This vulnerability can cause silent overwriting of configuration keys with falsy values, leading to structural type confusion in the parsed configuration object. Applications that rely on boolean checks of these keys may behave incorrectly, potentially enabling unintended code paths or logic errors. There is no impact on confidentiality or availability, and no prototype pollution occurs. The CVSS score is 5.3 (medium severity), reflecting limited impact on integrity without elevation of privileges or denial of service.

Upgrade to js-toml version 1.1.2 or later, which corrects the duplicate-key detection logic and enforces the TOML specification by generating parse errors on duplicate keys. Patch status is confirmed by the vendor advisory indicating the fix is in version 1.1.2. No other mitigations are required.