Description
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
Published: 2026-09-03
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

toml-node uses a Peggy-generated recursive‑descent parser that recurses through nested arrays and inline tables without a depth limit. An attacker can supply a TOML document with thousands of nested structures, causing the Node.js call stack to overflow. The parser raises an unexpected RangeError instead of a SyntaxError, terminating an unprotected request worker or process. This flaw is a classic uncontrolled recursion leading to denial of service and is classified as CWE‑674.

Affected Systems

BinaryMuse toml-node v4.2.0 and earlier are affected. The issue was fixed in toml-node 4.2.0.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5 and a currently unavailable EPSS score, indicating a moderate to high risk but unknown real‑world exploitation probability. It is not listed in the CISA KEV catalog. The intended attack vector is remote and unauthenticated: any application that parses an attacker‑controlled TOML document can trigger the crash without authentication or elevated privileges.

Generated by OpenCVE AI on September 3, 2026 at 21:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade toml-node to version 4.2.0 or later.
  • If an upgrade is not immediately possible, validate or reject TOML documents that exceed a reasonable nesting depth or size limit to prevent stack exhaustion.
  • Consider using an alternative parser or wrapper that enforces explicit depth limits when parsing TOML input.

Generated by OpenCVE AI on September 3, 2026 at 21:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-82x6-q7mm-w9cf toml-node: Uncontrolled Recursion
History

Thu, 03 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
Title toml-node: Uncontrolled Recursion
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-03T20:37:22.758Z

Reserved: 2026-08-20T20:07:49.962Z

Link: CVE-2026-77465

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T21:17:21.803

Modified: 2026-09-03T21:17:21.803

Link: CVE-2026-77465

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T21:45:09Z

Weaknesses