The vulnerability is a quadratic‑complexity denial of service that occurs when toml-node’s toml.parse() repeatedly rescans the entire assignedPaths and valueAssignments data structures for every array‑of‑tables header. Because distinct [[name]] paths are not pruned, a TOML document containing many such headers causes the parser to perform a repetitive, synchronous scan, blocking the Node.js event loop and preventing other operations from executing. This flaw is a classic example of CWE‑407 and CWE‑1322, where a program fails to consider the impact of its logic on resource usage or time complexity.

BinaryMuse toml-node libraries used in Node.js or browser environments are affected prior to version 5.0.1. Any application that parses user‑supplied TOML files with this library may experience a denial of service until the library is upgraded to v5.0.1 or later, which contains the fix.

The CVSS score of 8.7 classifies this vulnerability as high severity. The EPSS score is < 1%, indicating a very low probability that the vulnerability will be actively exploited. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can provide a crafted TOML file to an application that uses the older parser may trigger the quadratic scan, causing the service to become unresponsive. The attack vector is likely local or remote depending on how the application accepts TOML input, but the impact is a denial of service to all processes sharing the Node.js event loop.