CVE-2026-63386 Details
Description
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The exception is synchronous and catchable by consumers that handle all exceptions, and the issue does not affect confidentiality or integrity. This issue is fixed in version 1.1.3.
A denial-of-service vulnerability has been identified in js-toml, a TOML parser for JavaScript, in versions prior to 1.1.3. The issue arises because the load() function does not limit the depth of nesting or dotted keys in its recursive parsing process. This lack of restriction allows deeply nested arrays, inline tables, or long dotted keys to overwhelm the V8 call stack, causing a raw RangeError to be thrown instead of the expected SyntaxParseError. Applications that parse user-controlled TOML and only handle SyntaxParseError can inadvertently terminate a worker or process due to this unhandled exception.
Users can update to js-toml version 1.1.3 or later, where this vulnerability has been fixed. The updated version includes a configurable maxDepth option that allows users to set a maximum nesting depth for arrays, inline tables, and dotted keys, preventing the recursion from driving the parser past the call stack limit.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sunnyadn/js-toml/security/advisories/GHSA-3g82-77xr-68x5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sunnyadn/js-toml/commit/4e10acf1f99ff3cb443c58b8f0a57664e41e87c6 | [email protected] | Source CodeVendor |
| https://github.com/sunnyadn/js-toml/releases/tag/v1.1.3 | [email protected] | Release NotesVendor |
| https://github.com/sunnyadn/js-toml/security/advisories/GHSA-3g82-77xr-68x5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| js-toml | <= 1.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |