Memory Exhaustion Vulnerability in toml-node Parser by BinaryMuse

CVE-2026-114143

What is CVE-2026-114143?

The toml-node library, a TOML parser for Node.js, exhibits a significant performance issue related to its handling of long dotted keys and complex table structures. Prior to version 5.0.1, the parser would inefficiently slice and rejoin path prefixes during the assign and deep reference processes. This inefficiency could lead to severe delays in the Node.js event loop and, in extreme cases, result in process termination due to memory depletion. The ineffective maxDepth option offers no real protection against key-segment overload, leaving applications exposed to performance degradation and potential resource exhaustion. Users are encouraged to upgrade to version 5.0.1 to mitigate these risks.

References