toml-node: Denial of service via quadratic work in array-of-tables headers
Summary
The toml-node library (npm package toml) before 5.0.1 becomes very slow when toml.parse() processes a document with many distinct [[name]] array-of-tables headers. The parser rescans its bookkeeping sets for each header, so processing time grows quadratically and blocks the Node.js event loop. An attacker who can supply TOML input to an application can stall that process and deny service to other users, without authentication. No confidentiality or integrity impact is documented.
Affected
- toml-node (npm package toml) versions before 5.0.1
- Vendor and third-party range data is inconsistent; treat all versions before 5.0.1 as affected.
- Transitive dependencies in Node.js applications and tooling are affected too.
Fixed in
- Upgrade to toml-node 5.0.1 or later.
Workaround
Unknown. The vendor documents no workaround.
- Suggestion (not from a source): cap the size of TOML input from untrusted sources and parse such input in a worker process or with a timeout.
Exploitation
- No evidence of exploitation in the wild; CISA SSVC lists exploitation as none.
- No public proof of concept found. The advisory reports that a document of about 321 KB with 20,000 distinct array-of-tables headers takes about 10 seconds to parse.
- EPSS score: 0.00395.
Our recommendation
- Inventory Node.js projects for the toml package below 5.0.1, including transitive dependencies.
- Upgrade to 5.0.1 or later, and upgrade the related fixes CVE-2026-114143 and CVE-2026-114144 at the same time.
- Prioritise services that parse TOML from external input, such as uploads, API request bodies or remotely fetched configuration.
- Until patched, limit the size of untrusted TOML input and monitor for event loop stalls and high CPU usage.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 609c873 github.com
- Release v5.0.1 github.com
- GitHub Security Advisory GHSA-4qx8-w7c3-pj3p github.com
- GitLab Advisory Database: CVE-2026-114141 advisories.gitlab.com
- OSV: CVE-2026-114141 osv.dev
- OSV: GHSA-4qx8-w7c3-pj3p osv.dev
- Vulners: CVE-2026-114141 EPSS vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:56.
Original description (NVD)
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.