CVE-2026-114143 Details
Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
A denial-of-service vulnerability has been identified in toml-node, a TOML parser for Node.js and the browser, in versions prior to 5.0.1. The issue arises in the 'lib/compiler.js' file, where the 'toml.parse()' function inefficiently handles long dotted keys, table headers, array-of-tables headers, and inline-table keys. This processing creates a quadratic complexity that can freeze the Node.js event loop for several seconds. Furthermore, excessively long paths can lead to memory exhaustion, causing the Node.js process to crash. The vulnerability is not mitigated by the 'maxDepth' option, which fails to limit the number of key segments.
Users can update to toml-node version 5.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606 | [email protected] | Source CodeVendor |
| https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1 | [email protected] | Release NotesVendor |
| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BinaryMuse toml-node | <= 5.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |