Remote Code Execution Risk in toml-node Parser for Node.js

CVE-2026-77465

What is CVE-2026-77465?

The toml-node library, a TOML parser utilized in both Node.js and browser environments, has a vulnerability in its parsing mechanism that allows for potential remote code execution. Specifically, the recursive-descent parser in versions earlier than 4.2.0 lacks a depth limit for nested arrays and inline tables. This flaw can be exploited by sending a malicious TOML document with extensive nested structures, which can lead to the exhaustion of the Node.js call stack and result in an unexpected termination of the process. To mitigate this risk, upgrading to version 4.2.0 or later is essential.

References