js‑toml contains an unbounded recursive parser that permits deeply nested arrays, inline tables, or exceptionally long dotted keys. When such input is supplied to the load function, the V8 engine exhausts the call stack and throws a RangeError instead of the documented SyntaxParseError. This flaw matches CWE‑674 and can terminate the worker process or entire application if the exception propagates, creating a denial of service without affecting confidentiality or integrity.

All versions of sunnyadn js‑toml prior to 1.1.3 are affected. Any JavaScript or Node.js application that imports this parser and processes attacker‑controlled TOML—such as configuration files, user uploads, or network‑received payloads—must ensure the vulnerable load function is not used or is patched. The error originates in src/load/parser.ts and src/load/interpreter.ts and has been addressed in the 1.1.3 release.

The CVSS score of 5.3 labels the impact as medium, and no EPSS data is currently available. Although the vulnerability is not listed in CISA’s KEV catalog, its exploitation is straightforward: an attacker who can supply malicious TOML to the parser can trigger a stack exhaustion synchronously. The exception is catchable, but applications that only handle SyntaxParseError allow the RangeError to propagate and crash the process. Remediation depends on applying the fix or implementing robust error handling to mitigate the denial of service potential.