Toml-node: Uncontrolled Resource Consumption (CPU DoS) Via Unbounded-length Integer Literals In Toml.parse()

Summary "toml.parse" converts integer literals hex, octal, binary, and decimal to "BigInt" without first bounding the length of the digit sequence. Since "BigIntstring" construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one...

EUVD-2026-107553

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

EUVD-2026-107552

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse...

GHSA-4QX8-W7C3-PJ3P toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

EUVD-2026-107555

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse...

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

npm: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

GHSA-9J65-HCG3-GC64 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via a single long dotted key, table header, or inline-table key. A 100KB crafted document causes a multi-second synchronous hang; a 200KB document crashes the Node.js process outright with an uncatchable out-of-memor...

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via a single long dotted key, table header, or inline-table key. A 100KB crafted document causes a multi-second synchronous hang; a 200KB document crashes the Node.js process outright with an uncatchable out-of-memor...

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

EUVD-2026-107556

toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse...

GHSA-9QMH-M7C6-F92P toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

npm: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

npm: toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

Linux Distros Unpatched Vulnerability : CVE-2026-114141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete...

Linux Distros Unpatched Vulnerability : CVE-2026-114143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while...

Linux Distros Unpatched Vulnerability : CVE-2026-114144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...