CVE-2026-77465

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.2.0

Description A remote unauthenticated attacker can cause a denial of service in Node.js applications by providing a specially crafted TOML document. The toml.parse() function uses a recursive-descent parser that lacks a depth limit when processing nested arrays and inline tables. An attacker can provide a small payload (approximately 5-6 KB) containing a few thousand nested arrays or inline tables to exhaust the Node.js call stack. This results in an unexpected RangeError (Maximum call stack size exceeded) instead of a standard SyntaxError, which can terminate the request worker or the entire process. The issue resides in the mutual recursion between the peg$parsevalue(), peg$parsearray(), and peg$parseinline table entry() functions within lib/parser.js.

Recommendations Update to version 4.2.0. As a temporary mitigation, bound the nesting depth of brackets ([ and {) in untrusted input to a few hundred levels before passing the data to the toml.parse() function.