Threat database

CVE-2026-114144 is a high-severity vulnerability in the toml-node library prior to version 5.0.1. It involves uncontrolled resource consumption due to the parsing of unbounded integer digit sequences that are converted to BigInt before range checking. This causes super-linear CPU usage and blocks the Node.js event loop, enabling denial of service via a crafted TOML document. The issue is fixed in version 5.0.1.

CVE-2026-114143 is a high-severity vulnerability in BinaryMuse's toml-node, a TOML parser for Node.js and browsers. Versions prior to 5.0.1 suffer from inefficient algorithmic complexity in handling long dotted keys and table headers, causing quadratic processing time. This can block the Node.js event loop for several seconds and may lead to process termination due to memory exhaustion. The maxDepth option does not mitigate this issue. The vulnerability is fixed in version 5.0.1.

CVE-2026-114142 is a high-severity prototype pollution vulnerability in the toml-node library for Node.js and browsers. Versions prior to 5.0.1 allow attacker-controlled properties to be written to Object.prototype due to improper handling of quoted key paths in the parsing process. This can lead to objects inheriting malicious properties. The issue is fixed in version 5.0.1.

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.