High severity · published Oct 21, 2026
CVE-2026-114143
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
New
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
toml-node · BinaryMuse
< 5.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114143
github.com
https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
github.com
https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
github.com
https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64
More from toml-node
8.8
CVE-2026-114142
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
8.7
CVE-2026-114141
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
8.2
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
7.5
CVE-2026-114144
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
7.5
CVE-2026-77465
toml-node: Uncontrolled Recursion