CVE-2026-114143: Npm/toml-node vulnerability
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using toml-node versions before 5.0.1 are exposed when they parse TOML input containing very long dotted-key paths, table headers, array-of-tables headers, or inline-table keys. This can affect both Node.js and browser consumers of the parser.
What does an attacker need to exploit it?
An attacker needs the application to parse crafted TOML containing sufficiently long key paths. Processing those paths can consume quadratic work, blocking the Node.js event loop for several seconds, and may exhaust memory and terminate the process.
Does configuring maxDepth mitigate the issue?
No. The maxDepth option does not limit the number of key segments, so it does not mitigate the vulnerable long-path processing.
What is the remediation?
Upgrade toml-node to version 5.0.1, which fixes the issue.