Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Michelle Tilley: Versions of the TOML Parser for Node.js prior to 5.0.1 contain a resource management error vulnerability. This vulnerability arises because the addTableArray function in lib/compiler.js re-scans the entire set of assignedPaths and valueAssignments records for each array table...

Michelle Tilley TOML Parser for Node.js input validation error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain an input validation error vulnerability. This vulnerability arises because quoteDottedString in lib/compiler.js generates identical bookkeeping strings for different quote key paths, allowing addTableArray to bypass...

Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain a resource management error vulnerability. This vulnerability arises because toml.parse passes unbounded sequences of hexadecimal, octal, binary, and decimal digits from lib/parser.js to BigInt before performing checks...

Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Michelle Tilley’s TOML Parser for Node.js versions prior to 5.0.1 contain a resource management error vulnerability. This vulnerability arises from repeatedly slicing and reassembling path prefixes when handling long point-based keys, header fields, array headers, and inline table keys. This...

Security Bulletin: a vulnerability has been addressed in IBM Concert Network Observability

Summary IBM Concert Network Observability has addressed this security vulnerability with a Network Collectors update. Vulnerability Details ID:WS-2026-0062 DESCRIPTION: Unbounded mutual recursion in the TOML parser of github.com/pelletier/go-toml/v2. "unstable.Parser.parseVal" dispatches nested...

CLEANSTART-2026-VM09695 toml-node is a TOML parser for Node

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

CLEANSTART-2026-GB44071 toml-node is a TOML parser for Node

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

PT-2026-117884

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...

Linux Distros Unpatched Vulnerability : CVE-2026-77465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose...

SUSE CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

Unchecked Input for Loop Condition

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse by supplying a TOML document with a value in an...

CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

A flaw was found in smol-toml, a TOML parser and serializer. A remote attacker could exploit an infinite loop in the parse function by providing a specially crafted TOML document. This occurs when a value within an array or inline table is followed by a comment without a trailing newline...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...