High severity · published Oct 21, 2026
CVE-2026-114141
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
New
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
toml-node · BinaryMuse
< 5.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114141
github.com
https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
github.com
https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
github.com
https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p
More from toml-node
8.8
CVE-2026-114142
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
8.7
CVE-2026-114143
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
8.2
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
7.5
CVE-2026-114144
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
7.5
CVE-2026-77465
toml-node: Uncontrolled Recursion