toml-node: Denial of service via quadratic complexity in toml.parse()
Summary
toml-node, a TOML parser for Node.js and the browser, has a quadratic-complexity flaw in toml.parse() when it processes long dotted keys, table headers, array-of-tables headers and inline-table keys. An attacker who can supply TOML input to an affected application can block the Node.js event loop for several seconds or crash the process through memory exhaustion. The maxDepth option does not limit key segments and does not mitigate the issue. Applications with a publicly reachable TOML parsing endpoint are at risk; there is no confidentiality or integrity impact.
Affected
- toml-node (npm package toml) versions before 5.0.1, according to the CNA data
- Mend lists only 5.0.0 to 5.0.1; this range is likely incomplete, so treat all versions before 5.0.1 as affected
Fixed in
- Version 5.0.1 or later
Workaround
- No vendor workaround. The maxDepth option does not mitigate this issue.
- Interim measures until the upgrade (not from the vendor): limit the size of TOML input before parsing, and parse untrusted TOML in a worker thread or separate process with a timeout
Exploitation
- No exploitation in the wild is known in the sources checked.
- CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'partial'.
- No separate public exploit was found. The advisory describes the trigger only in general terms.
Our recommendation
- Run 'npm ls toml' and search for toml-node across Node.js projects, including transitive dependencies.
- Upgrade to version 5.0.1 or later, starting with services that parse user-supplied TOML.
- Until the upgrade is done, limit TOML input size and move parsing out of the main event loop.
- Monitor affected services for slow responses and process crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9j65-hcg3-gc64 github.com
- Fix commit 609c873 github.com
- Release v5.0.1 github.com
- OSV: CVE-2026-114143 osv.dev
- GitLab Advisory Database: CVE-2026-114143 advisories.gitlab.com
- Tenable: CVE-2026-114143 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:57.
Original description (NVD)
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
NVD references (4)
- https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
- https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64
- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.