{"id":"EUVD-2026-107555","revision":null,"records":[{"revision":"22d6f272abcd422dbc8535282b166fd9","observedAt":"2026-10-28T02:51:34.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-114143","aliases":[],"title":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.","state":0,"publishedAt":"2026-10-21T20:31:01.539+00:00","modifiedAt":"2026-10-28T01:45:01.59+00:00","affected":[{"ecosystem":"Vendor product","name":"toml-node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"BinaryMuse\",\n                    \"product\": \"toml-node\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.0.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114143","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114143","identifiers":["CVE-2026-114143"]},"retained":false,"historicalAffected":[]},{"revision":"698b9da633154ae4aa85bbfc084d1237","observedAt":"2026-10-30T01:59:06.365+00:00","statement":{"source":"euvd","id":"EUVD-2026-107555","aliases":["CVE-2026-114143","GHSA-9j65-hcg3-gc64"],"title":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-ta…","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107555","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 21, 2026, 8:31:01 PM","dateUpdated":"Oct 28, 2026, 1:45:01 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-107555","identifiers":["EUVD-2026-107555","CVE-2026-114143","GHSA-9j65-hcg3-gc64"]},"retained":false,"historicalAffected":[]},{"revision":"125022e1b5a7436b8834c0dbff07f4e7","observedAt":"2026-10-29T06:48:04.607+00:00","statement":{"source":"nvd","id":"CVE-2026-114143","aliases":[],"title":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-ta…","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.","state":0,"publishedAt":"2026-10-21T21:17:56.963+00:00","modifiedAt":"2026-10-28T02:17:05.51+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-407"],"productCriteria":[],"sourceDates":{"published":"2026-10-21T21:17:56.963","lastModified":"2026-10-28T02:17:05.510"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-114143","identifiers":["CVE-2026-114143"]},"retained":false,"historicalAffected":[]},{"revision":"8c8b41c69dac480dae8e6a46efa2cac8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9j65-hcg3-gc64","aliases":["CVE-2026-114143"],"title":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","description":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single\nlong dotted key, table header, or inline-table key. A ~100KB crafted document causes a\nmulti-second synchronous hang; a ~200KB document crashes the Node.js process outright with an\nuncatchable out-of-memory error. This is a separate, unpatched code path from the previously\nfixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at\nall, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue.\n\n## Affected component / version\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n  the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n  Not exhaustively verified against every prior release, but the affected functions are\n  unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n  predates that release as well.\n\n## Details\n\n`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to\n`parser.parse()` and then `compiler.compile()` with no length or structural validation.\nInside `lib/compiler.js`, three separate functions each walk a dotted key's segments in a\n`for` loop and, on **every** iteration, recompute the full path-prefix string from scratch:\n\n- `assign()` (lines 69-107, the sink at line 81): `var intermediatePath =\n  makeFullPath(keys.slice(0, i + 1));` — reached for top-level dotted-key assignments like\n  `a.b.c = 1`.\n- `deepRef()` (lines 247-281, the sink at line 252): the identical pattern via\n  `pathKey(keys.slice(0, i + 1))` — reached from table headers `[a.b.c]` and array-of-tables\n  `[[a.b.c]]` via `setPath()`/`addTableArray()`.\n- `setNestedKey()` (lines 184-202, the sink at line 187): the identical pattern — reached from\n  inline-table dotted keys like `t = { a.b.c = 1 }`.\n\n`keys.slice(0, i + 1)` allocates a new array of length `i`; `pathKey()`/`makeFullPath()`\n(lines 311-317) then does `.map(quoteDottedString).join(\".\")`, also O(i). Since this runs on\nevery one of the `n` segments of a dotted key, total work is `O(1 + 2 + ... + n) = O(n²)`, not\n`O(n)`. The string is computed unconditionally on the happy path (only ever *used* if an error\nis about to be thrown), so there is no early exit that makes this cheap in practice.\n\nNo limit exists anywhere on dotted-key segment count: `dot_ended_table_key_part+` and\n`inline_dot_key_part+` in `src/toml.pegjs` (lines 122, 311) are unbounded `+` repetitions,\nparsed iteratively rather than through the grammar's `value` rule — so the existing\n`MAX_DEPTH`/`maxDepth` nesting guard (`src/toml.pegjs:141-151`, enforced in the generated\n`lib/parser.js:1022`) does not apply to key length at all. We confirmed this directly: setting\n`options.maxDepth: 1` (the strictest possible value) against a 16,000-segment key produced no\nmeasurable timing difference from the unrestricted case.\n\n## Proof of Concept\n\n```js\nconst toml = require('toml');\n\n// n-segment dotted key: \"k0.k1.k2. ... .k{n-1} = 1\"\nfunction segKey(n) {\n  const parts = [];\n  for (let i = 0; i < n; i++) parts.push('k' + i);\n  return parts.join('.') + ' = 1\\n';\n}\n\n// ~100.9 KB input -- takes ~6.6-6.8 seconds\ntoml.parse(segKey(16000));\n\n// ~200 KB input -- crashes the Node process:\n// \"FATAL ERROR: Ineffective mark-compacts near heap limit - JavaScript heap out of memory\"\ntoml.parse(segKey(32000));\n```\n\nMeasured timings (Node v22, direct execution against this repo):\n\n| n (segments) | input size | time |\n|---|---|---|\n| 1,000 | ~4.9 KB | 34 ms |\n| 8,000 | ~46.9 KB | 1.6 s |\n| 16,000 | ~100.9 KB | 6.8 s |\n| 32,000 | ~200 KB | **process crash (OOM)** |\n\nDoubling `n` from 8,000→16,000 roughly quadruples runtime (~4.2x), the signature of O(n²)\nrather than the expected O(n) (~2x). Independently reproduced with the identical scaling\nsignature for the table-header variant (`[k0. ... .k15999]`, exercising `deepRef()`) and the\ninline-table variant (`t = { k0. ... .k15999 = 1 }`, exercising `setNestedKey()`).\n\nWe also generalized this into a property-based fuzzing harness (fast-check, run under Node)\nthat automatically tests the \"doubling input size should not more than roughly double parse\ntime\" invariant across 12 structural dimensions of the grammar/compiler; it independently\nre-flags all three code paths above on every run, with no additional dimension confirmed\nvulnerable after follow-up investigation. The harness is available on request.\n\n## Impact\n\nNode.js is single-threaded — a synchronous multi-second-to-crashing `parse()` call blocks the\nentire event loop of the process calling it, stalling every other request/operation that\nprocess is handling, not just the attacker's own. At the upper end this is not merely a hang:\nan uncaught, process-terminating out-of-memory crash from a ~200KB attacker-supplied string is\na full denial of service requiring no authentication — just the ability to get one string\nparsed by an application using this library (config upload, API request body, imported\nmanifest, or any of this library's intended use cases).\n\n## Suggested remediation\n\nBuild the path prefix as an incrementally-extended string as the loop walks each segment\n(append one already-quoted segment per iteration to a running string) instead of re-slicing an\narray and re-joining the entire prefix from scratch on every iteration. For example, in\n`assign()`:\n\n```js\nfunction assign(node) {\n  var keys = node.key;\n  var value = node.value;\n  var off = node.offset;\n  if (!Array.isArray(keys)) keys = [keys];\n  var reduced = reduceValueNode(value);\n\n  var target = context;\n  var pathStr = pathKey(currentPath); // computed once, not per segment\n  for (var i = 0; i < keys.length - 1; i++) {\n    var k = keys[i];\n    var quotedK = quoteDottedString(k);\n    var intermediatePath = pathStr ? pathStr + \".\" + quotedK : quotedK; // O(new segment), not O(i)\n    pathStr = intermediatePath;\n    // ...same conditional logic as today, using intermediatePath\n    target = target[k];\n  }\n  // ...\n}\n```\n\nThe identical treatment applies to `deepRef()` and `setNestedKey()`. As defense-in-depth,\nconsider also capping total key-segment count or overall input size, the same way `maxDepth`\nalready caps nesting.\n\n\n## Credit\n\nDiscovered and reported by SecDim Security Research\nsecdim.com | @secdim | security@secdim.com","state":0,"publishedAt":"2026-10-22T16:38:06+00:00","modifiedAt":"2026-10-22T16:45:03.7295937+00:00","affected":[{"ecosystem":"npm","name":"toml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://nvd.nist.gov/vuln/detail/CVE-2026-114143","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"sourceUrl":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9j65-hcg3-gc64","identifiers":["GHSA-9j65-hcg3-gc64","CVE-2026-114143"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-31T17:06:49.5453808+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-31T17:06:49.5453808+00:00","lastSuccessAt":"2026-10-31T17:06:49.7005889+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:06:49.7005902+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9266d7b009bf9c4a0ccdcb5cbdea7f905cb3c4d92fd3b41581ece16b2cfdc4e7-784b766ea38315a717f0f300983019726d402e8f914672a2c27c9b5c7ac467c0","complete":true,"records":417579,"lastAttemptAt":"2026-10-31T17:04:51.2200836+00:00","lastSuccessAt":"2026-10-31T17:04:51.1803831+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:04:51.2200836+00:00","snapshotPublishedAt":"2026-10-31T16:26:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1ea90a365f5b43ef9a5b92be53fe0867","complete":true,"records":13565,"lastAttemptAt":"2026-10-31T17:07:15.7147939+00:00","lastSuccessAt":"2026-10-31T11:34:32.033+00:00","error":null,"lastVerifiedAt":"2026-10-31T11:34:32.033+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-31T17:06:49.5453808+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-31T17:06:49.5453808+00:00","lastSuccessAt":"2026-10-31T17:06:49.7014183+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:06:49.7014185+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-76f55bade79746ceb7d00f18b2c86efc","complete":true,"records":13578,"lastAttemptAt":"2026-10-31T17:07:15.0280111+00:00","lastSuccessAt":"2026-10-31T17:07:15.025+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:07:15.025+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-31T17:06:49.3868114+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:06:49.3868114+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-31T17:04:51.3839718+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:04:51.3839718+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-31T17:06:49.5070707+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:06:49.5070707+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-712291bb5a0ee4f1ca7325e317f98ff05e9ab8d14f863abf00a323d9e6d8331e","complete":true,"records":230994,"lastAttemptAt":"2026-10-31T17:06:49.2526999+00:00","lastSuccessAt":"2026-10-31T17:06:47.8999408+00:00","error":null,"lastVerifiedAt":"2026-10-31T17:06:49.2526999+00:00","snapshotPublishedAt":"2026-10-31T16:33:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}