CVE-2026-63386

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.3

Description The load() function fails to limit nesting or dotted-key depth within the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts. Consequently, processing deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack, triggering a raw RangeError instead of the expected SyntaxParseError. If an application parses attacker-controlled TOML and only handles SyntaxParseError, the unexpected exception can cause a worker or process to terminate, leading to a denial of service. This synchronous exception can be caught by consumers handling all exceptions and does not impact confidentiality or integrity.

Recommendations Update to version 1.1.3.