CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64
https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64

Configurations

No configuration.

History

28 Oct 2026, 02:17

Type	Values Removed	Values Added
References	~~() https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64 -~~	() https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64 -

21 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 21:17

Updated : 2026-10-28 02:17

NVD link : CVE-2026-114143

Mitre link : CVE-2026-114143

CVE.ORG link : CVE-2026-114143

JSON object : View

Products Affected

No product.

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-114143", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114143", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T01:38:59.568245Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "BinaryMuse", "product": "toml-node", "versions": [{"status": "affected", "version": "< 5.0.1"}]}]}], "published": "2026-10-21T21:17:56.963", "references": [{"url": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606", "source": "security-advisories@github.com"}, {"url": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64", "source": "security-advisories@github.com"}, {"url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1."}], "lastModified": "2026-10-28T02:17:05.510", "sourceIdentifier": "security-advisories@github.com"}