Vulnerability · Published Oct 21, 2026 · Assigned by GitHub_M
CVE-2026-114141toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
High 8.7
In plain English
A high-severity security flaw in toml-node from BinaryMuse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | toml | 5.0.1 | GHSA-4qx8-w7c3-pj3p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BinaryMuse | toml-node | < 5.0.1 |
Weakness: CWE-407 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N