CVE-2026-114141 ยท GHSA-4qx8-w7c3-pj3p
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
- Risk score
- 71/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A high-severity vulnerability in toml-node allows an attacker to cause a denial of service (DoS) by creating a document with many array-of-tables headers, leading to quadratic synchronous work and blocking the Node.js event loop.
- Affected
- {'products': ['toml-node'], 'packages': ['toml'], 'versions': ['<= 5.0.0']}
- Fix
- Upgrade to version 5.0.1 or later
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 8.7 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| toml | npm | <= 5.0.0 | 5.0.1 |
References
- https://github.com/advisories/GHSA-4qx8-w7c3-pj3p
- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p
- https://nvd.nist.gov/vuln/detail/CVE-2026-114141
- https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
- https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
- https://github.com/advisories/GHSA-4qx8-w7c3-pj3p
Original description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
Last activity 21 Oct 2026. Patch Forecast updates every hour.