CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-114141

The toml-node TOML parser for Node.js and the browser is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity. In versions prior to 5.0.1 , the addTableArray() function in lib/compiler.js fails to prune distinct [[name]] paths, causing it to rescan complete boo...

PT-2026-120811

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function allows writing attacker-controlled properties to Object.prototype. This occurs because the quoteDottedString function in lib/compiler.js generates identical bookkeeping...

PT-2026-120813

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before the reduceInteger function in lib/compiler.js verifies if the...

PT-2026-120810

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The addTableArray function within the toml.parse compiler in lib/compiler.js fails to prune distinct name paths. Consequently, it rescans the entire assignedPaths and valueAssignments bookkeeping...

PT-2026-120812

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function repeatedly slices and rejoins every path prefix in lib/compiler.js when processing long dotted keys, table headers, array-of-tables headers, and inline-table keys within the...

Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain a resource management error vulnerability. This vulnerability arises because toml.parse passes unbounded sequences of hexadecimal, octal, binary, and decimal digits from lib/parser.js to BigInt before performing checks...

Michelle Tilley TOML Parser for Node.js input validation error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain an input validation error vulnerability. This vulnerability arises because quoteDottedString in lib/compiler.js generates identical bookkeeping strings for different quote key paths, allowing addTableArray to bypass...

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

PT-2026-85247

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.1.2 Description the toml.parse function in lib/compiler.js allows an attacker to write arbitrary keys onto Object.prototype by routing a table path through a scalar value. This occurs because the deepRef function...

PT-2026-85360

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...