CVE-2026-114141
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
| CWE | CWE-407 |
| Vendor | binarymuse |
| Product | toml-node |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for binarymuse toml-node
Be the first to know when new unknown vulnerabilities affecting binarymuse toml-node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
BinaryMuse / toml-node
< 5.0.1