js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with "if (object[key])" instead of "if (key in object)". When the prior value is a falsy primitive — "false", "0", "0n", "0.0", "-0", or """" — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You cannot define any key or table more than once"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by "load()". A boolean-typed "false" (or numeric "0") becomes a truthy object. Host applications that gate behavior on "if (config.flag)", "if (!user.banned)", "if (config.allowDelete)", or "if (config.publicMode)" will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). "Object.prototype" is not polluted. The "Object.create(null)" mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.