The vulnerability originates from the toml.parse() routine in toml-node. During parsing, the function repeatedly slices and rejoins every path prefix for long dotted keys, table headers, array‑of‑tables headers, and inline‑table keys. This leads to quadratic time complexity, making the parser consume excessive CPU cycles and memory when confronted with very long paths. An attacker can exploit this to block the Node.js event loop for seconds or even terminate the process due to memory exhaustion. The bug is characterized by inefficient algorithm design (CWE‑407) and by excessive memory usage (CWE‑770).

BinaryMuse's toml-node package is vulnerable in all releases before 5.0.1. Affected systems are any Node.js or browser environments that import toml-node <5.0.1 and call toml.parse() on untrusted TOML input. The maxDepth option does not restrict the number of key segments and therefore offers no protection.

The CVSS score of 8.7 indicates a high severity DoS flaw. The EPSS score is 0.00291 (0.291%) and the vulnerability is not listed in CISA's KEV catalog. Exploitation does not require privileged code; an attacker only needs to supply a crafted TOML document with extremely long key names or table paths to the vulnerable parser. The impact is confined to the host running the Node.js process, potentially affecting availability for applications that rely on toml-node.