CVE-2026-63386: CWE-674: Uncontrolled Recursion in sunnyadn js-toml
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The exception is synchronous and catchable by consumers that handle all exceptions, and the issue does not affect confidentiality or integrity. This issue is fixed in version 1.1.3.
AI Analysis
Technical Summary
The js-toml JavaScript TOML parser before version 1.1.3 does not limit recursion depth in its parser and interpreter components. This allows an attacker to craft TOML input with deeply nested arrays, inline tables, or long dotted keys that exhaust the V8 JavaScript engine call stack, causing a synchronous RangeError instead of the expected SyntaxParseError. Applications that only handle SyntaxParseError may fail to catch this exception, potentially terminating processes or workers and causing denial of service. The vulnerability is addressed in version 1.1.3.
Potential Impact
An attacker can cause a denial of service by supplying malicious TOML input that triggers uncontrolled recursion and call stack exhaustion, leading to process or worker termination. There is no impact on data confidentiality or integrity.
Mitigation Recommendations
Upgrade js-toml to version 1.1.3 or later, where this uncontrolled recursion issue is fixed. Applications should also ensure they handle all exceptions, not only SyntaxParseError, to avoid unexpected termination.
CVE-2026-63386: CWE-674: Uncontrolled Recursion in sunnyadn js-toml
Description
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The exception is synchronous and catchable by consumers that handle all exceptions, and the issue does not affect confidentiality or integrity. This issue is fixed in version 1.1.3.
CVSS v3.1
Score 5.3medium
Affected software
sunnyadn
js-toml
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The js-toml JavaScript TOML parser before version 1.1.3 does not limit recursion depth in its parser and interpreter components. This allows an attacker to craft TOML input with deeply nested arrays, inline tables, or long dotted keys that exhaust the V8 JavaScript engine call stack, causing a synchronous RangeError instead of the expected SyntaxParseError. Applications that only handle SyntaxParseError may fail to catch this exception, potentially terminating processes or workers and causing denial of service. The vulnerability is addressed in version 1.1.3.
Potential Impact
An attacker can cause a denial of service by supplying malicious TOML input that triggers uncontrolled recursion and call stack exhaustion, leading to process or worker termination. There is no impact on data confidentiality or integrity.
Mitigation Recommendations
Upgrade js-toml to version 1.1.3 or later, where this uncontrolled recursion issue is fixed. Applications should also ensure they handle all exceptions, not only SyntaxParseError, to avoid unexpected termination.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-16T17:39:30.171Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab2d481f7a7c54106a364cc
Added to database: 09/22/2026, 19:18:25 UTC
Last enriched: 09/22/2026, 19:33:50 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.