CVE-2026-77465: CWE-674: Uncontrolled Recursion in BinaryMuse toml-node

The toml-node package for Node.js and browsers uses a recursive-descent parser generated by Peggy 5.1.0. Prior to version 4.2.0, the parser's functions peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry recurse through nested arrays and inline tables without any depth limit. This uncontrolled recursion allows a remote unauthenticated attacker to supply a TOML document with thousands of nested arrays or inline tables, exhausting the Node.js call stack and causing a RangeError. This error terminates the parsing process unexpectedly, potentially causing denial of service by crashing unprotected request workers or processes. The vulnerability is tracked as CVE-2026-77465 and is classified under CWE-674 (Uncontrolled Recursion). The fix involves bounding the recursion depth in the parser, implemented in toml-node version 4.2.0.

An attacker can cause a denial of service by sending a specially crafted TOML document with deeply nested arrays or inline tables to an application using toml-node versions before 4.2.0. This triggers uncontrolled recursion in the parser, exhausting the call stack and causing the process or request worker to terminate unexpectedly. There is no impact on confidentiality or integrity, but availability is affected due to process termination.

Upgrade toml-node to version 4.2.0 or later, where the recursion depth is properly bounded in the parser. No other mitigations are specified. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in version 4.2.0.