Description
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
Published: 2026-09-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Crash / Denial of Service
Action: Immediate Patch
AI Analysis

Impact

toml-node uses a Peggy‑generated recursive‑descent parser that recurses through nested arrays and inline tables without a depth limit. An attacker can supply a TOML document with thousands of nested structures, causing the Node.js call stack to overflow. The parser raises an unexpected RangeError instead of a SyntaxError, terminating an unprotected request worker or process. This flaw is a classic uncontrolled recursion leading to denial of service and is classified as CWE‑606 and CWE‑674.

Affected Systems

BinaryMuse toml-node v4.2.0 and earlier are affected. The issue was fixed in toml-node 4.2.0.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5 and a currently unavailable EPSS score, indicating a moderate to high risk but unknown real‑world exploitation probability. It is not listed in the CISA KEV catalog. The intended attack vector is remote and unauthenticated: any application that parses an attacker‑controlled TOML document can trigger the crash without authentication or elevated privileges.

Generated by OpenCVE AI on September 4, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade toml-node to version 4.2.0 or later.
  • If an upgrade is not immediately possible, validate or reject TOML documents that exceed a reasonable nesting depth or size limit to prevent stack exhaustion.
  • Consider using an alternative parser or wrapper that enforces explicit depth limits when parsing TOML input.

Generated by OpenCVE AI on September 4, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-82x6-q7mm-w9cf toml-node: Uncontrolled Recursion
History

Fri, 04 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Binarymuse
Binarymuse toml-node
Vendors & Products Binarymuse
Binarymuse toml-node

Fri, 04 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 03 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
Title toml-node: Uncontrolled Recursion
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Binarymuse Toml-node
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-04T13:41:25.761Z

Reserved: 2026-08-20T20:07:49.962Z

Link: CVE-2026-77465

cve-icon Vulnrichment

Updated: 2026-09-04T13:28:20.381Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T21:17:21.803

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-77465

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-03T20:37:22Z

Links: CVE-2026-77465 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:22:09Z

Weaknesses
  • CWE-606

    Unchecked Input for Loop Condition

  • CWE-674

    Uncontrolled Recursion