Multiple security vulnerabilities have been identified in the toml package for Node.js, affecting versions 5.0.0 and earlier. The flaws are denial-of-service issues in the parsing and compilation stages that can be triggered by crafted TOML input. An unauthenticated attacker who can supply a document can cause excessive CPU consumption, prolonged blocking, or process termination, creating an overall high availability risk.
CVE-2026-114144 (CVSS 7.5 — High): The integer conversion path in the toml package's parser accepts unbounded-length numeric literals and converts them to large integer objects before range validation. An attacker can submit a small document containing one very long integer literal to exhaust CPU and block the event loop without authentication.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the toml package for Node.js, affecting versions 5.0.0 and earlier. The flaws are denial-of-service issues in the parsing and compilation stages that can be triggered by crafted TOML input. An unauthenticated attacker who can supply a document can cause excessive CPU consumption, prolonged blocking, or process termination, creating an overall high availability risk.
CVE-2026-114144 (CVSS 7.5 — High): The integer conversion path in the toml package's parser accepts unbounded-length numeric literals and converts them to large integer objects before range validation. An attacker can submit a small document containing one very long integer literal to exhaust CPU and block the event loop without authentication.[emaillocker id="1283"]
CVE-2026-114143 (CVSS 8.7 — High): The compiler stage processes long dotted keys or table paths with quadratic complexity because it repeatedly rebuilds full path prefixes for each segment. An attacker can provide a moderately sized document with a very long dotted key to cause multi-second hangs or an out-of-memory crash without authentication.
CVE-2026-114141 (CVSS 8.7 — High): The compiler stage handles many array-of-tables headers by repeatedly scanning accumulated path bookkeeping structures without pruning unrelated entries, producing quadratic work. An attacker can supply a document containing many distinct array-of-tables headers to cause prolonged CPU blocking without authentication.
These vulnerabilities collectively present a high availability risk for any application that parses untrusted or third-party TOML documents. Services that accept configuration uploads, request bodies, or imported manifests are most exposed. Organizations should prioritize assessing their exposure to untrusted TOML input.
We recommend you to update toml to version 5.0.1.
The following reports contain further technical details:
[/emaillocker]