npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

GHSA-9J65-HCG3-GC64 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via a single long dotted key, table header, or inline-table key. A 100KB crafted document causes a multi-second synchronous hang; a 200KB document crashes the Node.js process outright with an uncatchable out-of-memor...

CVE-2026-114143

A flaw was found in toml-node. A remote attacker could cause a Denial of Service DoS by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory...

CVE-2026-85278

jackson-dataformat-toml 2.15.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6 and 3.2.0 before 3.2.2: TOML dotted keys create nested tables without checking StreamReadConstraints.maxNestingDepth for each key segment, so a long dotted key bypasses the nesting limit...

GHSA-F49M-VF83-692W i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...

CVE-2026-48714 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not...

CVE-2026-48714

The CVE-2026-48714 issue affects i18next-http-middleware prior to 3.9.7. The missingKeyHandler can accept request-body keys like proto , constructor, and prototype (and similar dotted variants) and, when downstream backends such as i18next-fs-backend ≤ 2.6.5 split on keySeparator, passes them to ...