Denial of Service Vulnerability in js-toml by Sunnyadn

CVE-2026-63386

What is CVE-2026-63386?

The js-toml library, a TOML parser for JavaScript, contains a vulnerability that can be exploited through deeply nested arrays or long dotted keys. Prior to version 1.1.3, the load() function fails to limit nesting or dotted-key depth in its recursive parser, allowing crafted TOML input to lead to a RangeError instead of the expected SyntaxParseError if improperly handled. This can result in the termination of a worker or process, thereby causing a denial of service. It is essential for applications that utilize js-toml to upgrade to version 1.1.3 or later to mitigate this risk.

References