Toml-node: Uncontrolled Resource Consumption (CPU DoS) Via Unbounded-length Integer Literals In Toml.parse()

Summary "toml.parse" converts integer literals hex, octal, binary, and decimal to "BigInt" without first bounding the length of the digit sequence. Since "BigIntstring" construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one...

EUVD-2026-107553

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype vulnerability discovered by ? in WordPress npm tome versions = 5.0.0...

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

EUVD-2026-107552

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse...

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

EUVD-2026-107555

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse...

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via a single long dotted key, table header, or inline-table key. A 100KB crafted document causes a multi-second synchronous hang; a 200KB document crashes the Node.js process outright with an uncatchable out-of-memor...

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

GHSA-9QMH-M7C6-F92P toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

npm: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

npm: toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

EUVD-2026-107556

toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse...

Linux Distros Unpatched Vulnerability : CVE-2026-114141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete...

Linux Distros Unpatched Vulnerability : CVE-2026-114144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from...

Linux Distros Unpatched Vulnerability : CVE-2026-114143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while...

CVE-2026-114143

A flaw was found in toml-node. A remote attacker could cause a Denial of Service DoS by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...