CVE-2026-114143 · GHSA-9j65-hcg3-gc64
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
- Risk score
- 71/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A quadratic-complexity DoS vulnerability exists in toml-node versions prior to 5.0.1, allowing an attacker to block the Node.js event loop or terminate the process through memory exhaustion by providing long dotted keys or table paths.
- Affected
- {'products': ['toml-node'], 'packages': ['toml'], 'versions': ['<= 5.0.0']}
- Fix
- Upgrade to version 5.0.1 or later
- Exploitation
- Public proof of concept
Story map
At a glance
toml: Amber, patch this week. A quadratic-complexity DoS vulnerability exists in toml-node versions prior to 5.0.1, allowing an attacker to block the Node.js event loop or terminate the process through memory exhaustion by providing long dotted keys or table paths.
The flaws
- CVE-2026-114143: Toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() (CVSS 8.7 · EPSS 0%)
- CVE-2026-114141: Toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() (CVSS 8.7 · EPSS 0%)
- CVE-2026-114144: Toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() (CVSS 7.5 · EPSS 0%)
The fix
Upgrade toml: 5.0.1 or later on your release line
Who is exposed: {'products': ['toml-node'], 'packages': ['toml'], 'versions': ['<= 5.0.0']}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-407). 69 other warnings in 30 days
Why it is Amber
- CVSS 8.7 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| toml | npm | <= 5.0.0 | 5.0.1 |
References
- https://github.com/advisories/GHSA-9j65-hcg3-gc64
- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64
- https://nvd.nist.gov/vuln/detail/CVE-2026-114143
- https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
- https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
- https://github.com/advisories/GHSA-9j65-hcg3-gc64
Original description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
Last activity 21 Oct 2026. Patch Forecast updates every hour.