Performance Issue in toml-node Parser for Node.js and Browsers

CVE-2026-114141

What is CVE-2026-114141?

The toml-node library, a parser for TOML files in Node.js, has a performance vulnerability in the addTableArray() function before version 5.0.1. Due to a flaw in the bookkeeping process for array-of-tables headers, the function may rescan the entire list of assignedPaths and valueAssignments. This can lead to excessive computation, resulting in significant delays and potentially blocking the Node.js event loop. As a consequence, this vulnerability can allow an attacker to deny service to legitimate users by monopolizing processing resources. The issue has been addressed in the 5.0.1 release, which optimizes the way these paths are handled.

References