CVE-2026-114141

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1

Description The addTableArray() function within the toml.parse() compiler in lib/compiler.js fails to prune distinct [[name]] paths. Consequently, it rescans the entire assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Processing a document containing numerous such headers results in quadratic synchronous work, which can block the Node.js event loop and lead to a denial of service for other operations in the process.

Recommendations Update to version 5.0.1.