CVE-2026-114141: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
toml-nodeto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using toml-node before 5.0.1 are exposed if they parse TOML documents whose contents can be influenced by an attacker. The impact is most relevant to Node.js processes because the synchronous parsing work can block the event loop and delay other operations in the same process.
What input is needed to trigger the problem?
An attacker needs to cause toml.parse() to process a TOML document containing many distinct array-of-tables headers, such as [[name]] paths. Each header causes rescanning of accumulated bookkeeping data, producing quadratic work.
What should be done if the application cannot immediately upgrade?
Avoid parsing untrusted TOML input, or enforce strict limits on the number of array-of-tables headers and the overall size or complexity of TOML documents before calling toml.parse(). This reduces the ability to submit inputs that monopolize the Node.js event loop.
How can I determine whether a deployment is affected?
Check whether the application depends on npm/toml-node at a version earlier than 5.0.1 and calls toml.parse() on attacker-influenced TOML. Version 5.0.1 contains the fix.