Vulnerability-Lookup

GHSA-4QX8-W7C3-PJ3P

Vulnerability from github – Published: 2026-10-22 16:38 – Updated: 2026-10-22 16:38

Summary

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Details

Summary

toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables ([[name]]) headers. addTableArray() in lib/compiler.js rescans two entire bookkeeping Sets on every [[name]] header without pruning unrelated or distinct entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections), not a contrived edge case. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) and requires no key nesting or dotted keys at all.

Affected component / version

Package: toml (npm), repository BinaryMuse/toml-node
Function: addTableArray() in lib/compiler.js
Confirmed present in the audited checkout at commit 1b2ac40 (2026-07-16), one commit past the v5.0.0 tag (a changelog-only change) — i.e. present in v5.0.0, the latest release. Not exhaustively verified against every prior release, but the affected function is unrelated to v5.0.0's BigInt/Temporal changes (per CHANGELOG.md), so the defect likely predates that release as well.

Details

toml.parse(input, options) (index.js:5-9) forwards the caller-supplied string to parser.parse() and then compiler.compile() with no length or structural validation. Every [[name]] (array-of-tables) header is routed (reduce(), lib/compiler.js:43) to addTableArray() (lib/compiler.js:218-245), which performs two full linear scans on every call:

assignedPaths.forEach(function(p) {
  if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);
});
valueAssignments.forEach(function(p) {
  if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);
});

(lib/compiler.js:228-233)

assignedPaths and valueAssignments accumulate one entry per top-level key/table/array path ever assigned in the entire document. Each scan prunes only entries matching the currently reopened path via isSameOrSubPath() (lib/compiler.js:319-321: path === prefix || path.indexOf(prefix + ".") === 0); anything else — an unrelated top-level key, or simply a different array-of-tables name — is never removed and is rescanned in full on every subsequent [[name]] header for the rest of the parse. Set.prototype.forEach has no early exit, so this is unconditionally O(current Set size) on every call, giving O(n²) total work for n such headers.

Proof of Concept

The sharpest reproduction needs no unrelated keys at all — just N array-of-tables headers with N distinct names, since nothing is ever pruned when no name repeats:

const toml = require('toml');

function distinctArrayHeaders(n) {
  let out = '';
  for (let i = 0; i < n; i++) out += `[[a${i}]]\nv = 1\n`;
  return out;
}

// ~321 KB input -- takes ~10.3 seconds
toml.parse(distinctArrayHeaders(20000));

Measured timings (Node, direct execution against this repo):

Variant	n	input size	time
N distinct-named `[[name]]` headers, no unrelated keys	20,000	321 KB	10.3 s
Same N with all-same-name headers (self-pruning, control)	20,000	240 KB	78 ms
M unrelated top-level keys + N same-name `[[name]]` headers	M=N=32,000	906 KB	42.3 s

The ~130x gap between the distinct-name and same-name cases at identical N and comparable input size isolates the mechanism precisely: the bug is unbounded Set growth from never-pruned entries, not string length or any other confound. A product-law check (varying M and N independently in the mixed variant) further confirmed genuine O(M·N) complexity.

Impact

Node.js is single-threaded — this synchronous, multi-second-to-tens-of-seconds compile blocks the entire process event loop, standard uncontested Node.js behavior. The triggering document shape — flat top-level config keys plus one or more array-of-tables sections (e.g. a [db] settings block plus a [[servers]] list) — is unremarkable, common real-world TOML, not an edge case. No authentication or special access is required; only the ability to get one TOML string parsed by an application using this library.

Suggested remediation

Avoid scanning the entire assignedPaths/valueAssignments Sets on every [[name]] header. Index entries by their top-level path segment (e.g. a Map<string, Set<string>> keyed by the first key component) so addTableArray() only ever scans the bucket relevant to the path being reopened, in time proportional to that bucket's size rather than the whole document's accumulated path count:

var assignedByRoot = new Map(); // root segment -> Set<fullPath>

function addTableArray(node) {
  var path = node.value;
  var root = path[0];
  var bucket = assignedByRoot.get(root) || new Set();
  bucket.forEach(function(p) {
    if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);
  });
  // ...rest of addTableArray unchanged, reading/writing the per-root bucket
  // instead of the global assignedPaths/valueAssignments Sets
}

As with the sibling finding, an input-size or table-count limit would also help as defense-in-depth.

Credit

Discovered and reported by SecDim Security Research secdim.com | @secdim | security@secdim.com

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "toml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-114141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-22T16:38:44Z",
    "nvd_published_at": "2026-10-21T21:17:56Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n\u00b2)) denial-of-service via many\narray-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two\nentire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct\nentries, so a document containing n such headers costs O(n\u00b2) compiler work. A ~321KB document\nof 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse \u2014 a completely\nordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),\nnot a contrived edge case. This is a separate, unpatched code path from the previously fixed\nstack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.\n\n## Affected component / version\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Function: `addTableArray()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n  the `v5.0.0` tag (a changelog-only change) \u2014 i.e. present in `v5.0.0`, the latest release.\n  Not exhaustively verified against every prior release, but the affected function is\n  unrelated to `v5.0.0`\u0027s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n  predates that release as well.\n\n## Details\n\n`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to\n`parser.parse()` and then `compiler.compile()` with no length or structural validation. Every\n`[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to\n`addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every\ncall:\n\n```js\nassignedPaths.forEach(function(p) {\n  if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);\n});\nvalueAssignments.forEach(function(p) {\n  if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);\n});\n```\n(`lib/compiler.js:228-233`)\n\n`assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/array path\never assigned in the entire document. Each scan prunes only entries matching the *currently\nreopened* path via `isSameOrSubPath()` (`lib/compiler.js:319-321`: `path === prefix ||\npath.indexOf(prefix + \".\") === 0`); anything else \u2014 an unrelated top-level key, or simply a\n*different* array-of-tables name \u2014 is never removed and is rescanned in full on every\nsubsequent `[[name]]` header for the rest of the parse. `Set.prototype.forEach` has no early\nexit, so this is unconditionally O(current Set size) on every call, giving O(n\u00b2) total work\nfor n such headers.\n\n## Proof of Concept\n\nThe sharpest reproduction needs no unrelated keys at all \u2014 just N array-of-tables headers with\nN *distinct* names, since nothing is ever pruned when no name repeats:\n\n```js\nconst toml = require(\u0027toml\u0027);\n\nfunction distinctArrayHeaders(n) {\n  let out = \u0027\u0027;\n  for (let i = 0; i \u003c n; i++) out += `[[a${i}]]\\nv = 1\\n`;\n  return out;\n}\n\n// ~321 KB input -- takes ~10.3 seconds\ntoml.parse(distinctArrayHeaders(20000));\n```\n\nMeasured timings (Node, direct execution against this repo):\n\n| Variant | n | input size | time |\n|---|---|---|---|\n| N distinct-named `[[name]]` headers, no unrelated keys | 20,000 | 321 KB | 10.3 s |\n| Same N with all-same-name headers (self-pruning, control) | 20,000 | 240 KB | 78 ms |\n| M unrelated top-level keys + N same-name `[[name]]` headers | M=N=32,000 | 906 KB | 42.3 s |\n\nThe ~130x gap between the distinct-name and same-name cases at identical N and comparable\ninput size isolates the mechanism precisely: the bug is unbounded Set growth from never-pruned\nentries, not string length or any other confound. A product-law check (varying M and N\nindependently in the mixed variant) further confirmed genuine O(M\u00b7N) complexity.\n\n## Impact\n\nNode.js is single-threaded \u2014 this synchronous, multi-second-to-tens-of-seconds compile blocks\nthe entire process event loop, standard uncontested Node.js behavior. The triggering document\nshape \u2014 flat top-level config keys plus one or more array-of-tables sections (e.g. a `[db]`\nsettings block plus a `[[servers]]` list) \u2014 is unremarkable, common real-world TOML, not an\nedge case. No authentication or special access is required; only the ability to get one TOML\nstring parsed by an application using this library.\n\n## Suggested remediation\n\nAvoid scanning the entire `assignedPaths`/`valueAssignments` Sets on every `[[name]]` header.\nIndex entries by their top-level path segment (e.g. a `Map\u003cstring, Set\u003cstring\u003e\u003e` keyed by the\nfirst key component) so `addTableArray()` only ever scans the bucket relevant to the path\nbeing reopened, in time proportional to that bucket\u0027s size rather than the whole document\u0027s\naccumulated path count:\n\n```js\nvar assignedByRoot = new Map(); // root segment -\u003e Set\u003cfullPath\u003e\n\nfunction addTableArray(node) {\n  var path = node.value;\n  var root = path[0];\n  var bucket = assignedByRoot.get(root) || new Set();\n  bucket.forEach(function(p) {\n    if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);\n  });\n  // ...rest of addTableArray unchanged, reading/writing the per-root bucket\n  // instead of the global assignedPaths/valueAssignments Sets\n}\n```\n\nAs with the sibling finding, an input-size or table-count limit would also help as\ndefense-in-depth.\n\n## Credit\n\nDiscovered and reported by SecDim Security Research\nsecdim.com | @secdim | security@secdim.com",
  "id": "GHSA-4qx8-w7c3-pj3p",
  "modified": "2026-10-22T16:38:44Z",
  "published": "2026-10-22T16:38:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BinaryMuse/toml-node"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()"
}

CVE-2026-114141 (GCVE-0-2026-114141)

Vulnerability from cvelistv5 – Published: 2026-10-21 20:25 – Updated: 2026-10-21 20:25

Title

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7658 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/BinaryMuse/toml-node/security/…	x_refsource_CONFIRM
https://github.com/BinaryMuse/toml-node/commit/60…	x_refsource_MISC
https://github.com/BinaryMuse/toml-node/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
BinaryMuse	toml-node	Affected: < 5.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "toml-node",
          "vendor": "BinaryMuse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler\u0027s addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T20:25:36.396Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4qx8-w7c3-pj3p",
        "discovery": "UNKNOWN"
      },
      "title": "toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114141",
    "datePublished": "2026-10-21T20:25:36.396Z",
    "dateReserved": "2026-10-20T21:53:58.473Z",
    "dateUpdated": "2026-10-21T20:25:36.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-4QX8-W7C3-PJ3P

Summary

Affected component / version

Details

Proof of Concept

Impact

Suggested remediation

Credit

CVE-2026-114141 (GCVE-0-2026-114141)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour