CVE-2026-114143 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114143?
CVE-2026-114143 is a high-severity vulnerability in BinaryMuse toml-node, published on 21 Oct 2026.
Official description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.
Weakness: CWE-407
Which versions are affected by CVE-2026-114143?
2 open source packages ship an affected version, including toml.
| Package | Affected | Fixed in |
|---|---|---|
toml npm | All versions | 5.0.1 |
toml npm | All versions | 5.0.1 |
How do I fix CVE-2026-114143?
Upgrade toml to 5.0.1 or later.
Is CVE-2026-114143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114143 exists.
Sources
Also known as GHSA-9j65-hcg3-gc64, ROOT-APP-NPM-CVE-2026-114143.