{"id":"CVE-2026-114141","kind":"vulnerability","aliases":["CVE-2026-114141","GHSA-4qx8-w7c3-pj3p"],"related":[],"title":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","description":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many\narray-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two\nentire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct\nentries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document\nof 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely\nordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),\nnot a contrived edge case. This is a separate, unpatched code path from the previously fixed\nstack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.\n\n## Affected component / version\n\n- Package: `toml` (npm), repository `BinaryMuse/toml-node`\n- Function: `addTableArray()` in `lib/compiler.js`\n- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past\n  the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.\n  Not exhaustively verified against every prior release, but the affected function is\n  unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely\n  predates that release as well.\n\n## Details\n\n`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to\n`parser.parse()` and then `compiler.compile()` with no length or structural validation. Every\n`[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to\n`addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every\ncall:\n\n```js\nassignedPaths.forEach(function(p) {\n  if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);\n});\nvalueAssignments.forEach(function(p) {\n  if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);\n});\n```\n(`lib/compiler.js:228-233`)\n\n`assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/array path\never assigned in the entire document. Each scan prunes only entries matching the *currently\nreopened* path via `isSameOrSubPath()` (`lib/compiler.js:319-321`: `path === prefix ||\npath.indexOf(prefix + \".\") === 0`); anything else — an unrelated top-level key, or simply a\n*different* array-of-tables name — is never removed and is rescanned in full on every\nsubsequent `[[name]]` header for the rest of the parse. `Set.prototype.forEach` has no early\nexit, so this is unconditionally O(current Set size) on every call, giving O(n²) total work\nfor n such headers.\n\n## Proof of Concept\n\nThe sharpest reproduction needs no unrelated keys at all — just N array-of-tables headers with\nN *distinct* names, since nothing is ever pruned when no name repeats:\n\n```js\nconst toml = require('toml');\n\nfunction distinctArrayHeaders(n) {\n  let out = '';\n  for (let i = 0; i < n; i++) out += `[[a${i}]]\\nv = 1\\n`;\n  return out;\n}\n\n// ~321 KB input -- takes ~10.3 seconds\ntoml.parse(distinctArrayHeaders(20000));\n```\n\nMeasured timings (Node, direct execution against this repo):\n\n| Variant | n | input size | time |\n|---|---|---|---|\n| N distinct-named `[[name]]` headers, no unrelated keys | 20,000 | 321 KB | 10.3 s |\n| Same N with all-same-name headers (self-pruning, control) | 20,000 | 240 KB | 78 ms |\n| M unrelated top-level keys + N same-name `[[name]]` headers | M=N=32,000 | 906 KB | 42.3 s |\n\nThe ~130x gap between the distinct-name and same-name cases at identical N and comparable\ninput size isolates the mechanism precisely: the bug is unbounded Set growth from never-pruned\nentries, not string length or any other confound. A product-law check (varying M and N\nindependently in the mixed variant) further confirmed genuine O(M·N) complexity.\n\n## Impact\n\nNode.js is single-threaded — this synchronous, multi-second-to-tens-of-seconds compile blocks\nthe entire process event loop, standard uncontested Node.js behavior. The triggering document\nshape — flat top-level config keys plus one or more array-of-tables sections (e.g. a `[db]`\nsettings block plus a `[[servers]]` list) — is unremarkable, common real-world TOML, not an\nedge case. No authentication or special access is required; only the ability to get one TOML\nstring parsed by an application using this library.\n\n## Suggested remediation\n\nAvoid scanning the entire `assignedPaths`/`valueAssignments` Sets on every `[[name]]` header.\nIndex entries by their top-level path segment (e.g. a `Map<string, Set<string>>` keyed by the\nfirst key component) so `addTableArray()` only ever scans the bucket relevant to the path\nbeing reopened, in time proportional to that bucket's size rather than the whole document's\naccumulated path count:\n\n```js\nvar assignedByRoot = new Map(); // root segment -> Set<fullPath>\n\nfunction addTableArray(node) {\n  var path = node.value;\n  var root = path[0];\n  var bucket = assignedByRoot.get(root) || new Set();\n  bucket.forEach(function(p) {\n    if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);\n  });\n  // ...rest of addTableArray unchanged, reading/writing the per-root bucket\n  // instead of the global assignedPaths/valueAssignments Sets\n}\n```\n\nAs with the sibling finding, an input-size or table-count limit would also help as\ndefense-in-depth.\n\n## Credit\n\nDiscovered and reported by SecDim Security Research\nsecdim.com | @secdim | security@secdim.com","summary":"The toml npm package's toml.parse() takes quadratic time on documents with many array-of-tables ([[name]]) headers with distinct names, so a roughly 321 KB input takes about 10 seconds to parse and blocks the Node.js event loop. An attacker who can get one TOML string parsed by an application can stall that process (denial of service).","severity":"high","cvss":8.7,"epss":0.0029100000392645597,"exploited":false,"exploited_at":null,"products":[{"name":"toml","fixed":["5.0.1"],"affected":"<= 5.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-407","node.js","npm","package","self-hosted","toml"],"not_affected_if":["managed-hosting-with-input-limits","parses-only-trusted-input","toml-not-used"],"how_to_check":"Run npm ls toml and check whether the resolved version is 5.0.0 or lower.\nSearch lock files (package-lock.json, yarn.lock, pnpm-lock.yaml) for \"toml\" at a version <= 5.0.0.\nFind call sites with grep -rn \"toml.parse\\|require('toml')\" on code that parses untrusted input.","fix":"Upgrade the toml npm package to 5.0.1 or later.\nUntil then, limit the size of TOML input accepted from untrusted sources or parse it in a worker or child process with a timeout.","status":"open","published_at":"2026-10-21T21:17:56+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:06:40+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:06:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the toml npm package to 5.0.1 or later.\nUntil then, limit the size of TOML input accepted from untrusted sources or parse it in a worker or child process with a timeout.","summary":"The toml npm package's toml.parse() takes quadratic time on documents with many array-of-tables ([[name]]) headers with distinct names, so a roughly 321 KB input takes about 10 seconds to parse and blocks the Node.js event loop. An attacker who can get one TOML string parsed by an application can stall that process (denial of service).","category":"package","who_cares":["npm","toml","node.js","self-hosted"],"confidence":0.85,"analyst_note":"","how_to_check":"Run npm ls toml and check whether the resolved version is 5.0.0 or lower.\nSearch lock files (package-lock.json, yarn.lock, pnpm-lock.yaml) for \"toml\" at a version <= 5.0.0.\nFind call sites with grep -rn \"toml.parse\\|require('toml')\" on code that parses untrusted input.","needs_analyst":false,"not_affected_if":["toml-not-used","parses-only-trusted-input","managed-hosting-with-input-limits"],"severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":4100,"output_tokens":432,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-07':243C '-114141':19A,27A '-16':244C '-2026':18A,26A '-233':362C '-245':331C '-321':395C '-407':30B '-9':297C '0':400C,507C '000':155C,551C,569C,589C '1':515C '10':68B '10.3':162C,523C,554C '130x':595C '1b2ac40':241C '20':154C,550C,568C '20000':527C '2026':242C '218':330C '228':361C '240':570C '319':394C '32':588C '321':63B,519C,552C '321kb':151C '42.3':592C '43':326C '4qx8':22A '78':572C '82x6':208C '906':590C 'accumul':366C 'addtablearray':120C,230C,328C 'affect':221C,272C 'all-same-nam':559C 'anyth':401C 'applic':89B 'array':11A,52B,115C,182C,318C,414C,477C 'array-of-t':10A,51B,114C,181C,317C,413C,476C 'assign':376C 'assignedpath':363C 'assignedpaths.delete':349C 'assignedpaths.foreach':342C 'attack':79B 'audit':237C 'behavior':682C 'bigint/temporal':279C 'binarymuse/toml-node':228C 'block':73B,160C,176C,673C 'bookkeep':126C 'bug':619C 'call':340C,452C 'caller':301C 'caller-suppli':300C 'case':190C,606C 'chang':255C,280C 'changelog':253C 'changelog-on':252C 'changelog.md':282C 'check':640C 'checkout':238C 'code':196C 'commit':240C,246C 'compar':611C 'compil':148C,672C 'compiler.compile':308C 'complet':167C 'complex':6A,105C,656C 'compon':222C 'concept':464C 'config':691C 'confirm':233C,651C 'confound':635C 'const':495C 'contain':141C 'contriv':188C 'control':567C 'cost':145C 'current':388C,447C 'cve':17A,25A 'cwe':29B 'defect':285C 'denial':94B,109C 'denial-of-servic':108C 'detail':292C 'differ':412C 'direct':531C 'distinct':58B,136C,157C,483C,543C,600C 'distinct-nam':156C,542C,599C 'distinctarrayhead':500C,526C 'document':48B,140C,152C,380C,685C 'dos':7A,205C 'dot':217C 'earli':440C 'edg':189C 'els':402C 'entir':125C,379C,675C 'entri':137C,368C,385C,628C 'event':76B,677C 'ever':375C,488C 'everi':129C,267C,315C,339C,427C,451C 'execut':532C 'exhaust':264C 'exit':441C 'fix':201C 'flat':174C,687C 'forward':298C 'full':335C,425C 'function':229C,273C,343C,352C,499C 'gap':596C 'genuin':652C 'get':82B 'ghsa':21A,207C 'ghsa-4qx8-w7c3-pj3p':20A 'ghsa-82x6-q7mm-w9cf':206C 'give':453C 'growth':623C 'header':14A,56B,119C,131C,144C,321C,430C,461C,480C,546C,563C,585C 'host':36B 'i.e':256C 'ident':608C 'impact':657C 'independ':645C 'index.js:5':296C 'input':65B,294C,521C,538C,612C 'isol':614C 'issameorsubpath':346C,355C,392C 'js':341C,494C 'kb':64B,520C,553C,571C,591C 'key':214C,218C,408C,471C,549C,579C,692C 'key/table/array':373C 'latest':261C 'law':639C 'length':311C,631C 'let':502C,505C 'level':372C,407C,578C,690C 'lib/compiler.js':122C,232C,325C,329C,360C,393C 'like':286C 'linear':336C 'look':170C 'loop':77B,678C 'm':574C,586C,642C,654C 'mani':9A,50B,113C 'match':386C 'measur':528C 'mechan':616C 'mix':648C 'ms':573C 'multi':666C 'multi-second-to-tens-of-second':665C 'n':107C,142C,147C,455C,459C,475C,482C,501C,509C,516C,537C,541C,557C,580C,587C,609C,644C,655C 'name':55B,59B,118C,130C,158C,159C,316C,417C,429C,484C,492C,544C,545C,562C,583C,584C,601C,605C 'need':468C 'nest':215C 'never':419C,626C 'never-prun':625C 'node':3A,530C 'node.js':31B,75B,658C,681C 'noth':486C 'npm':32B,40B,226C 'nv':514C 'o':106C,146C,446C,454C,653C 'one':83B,178C,245C,367C,694C 'option':295C 'ordinari':169C 'ordinary-look':168C 'overflow':204C 'p':344C,347C,350C,353C,356C,359C 'packag':33B,41B,224C 'pars':71B,86B,165C,436C 'parser.parse':305C 'past':247C 'path':197C,374C,390C,396C 'path.indexof':398C 'per':281C,369C 'perform':333C 'pj3p':24A 'plus':177C,693C 'precis':617C 'predat':287C 'prefix':397C,399C 'present':234C,257C 'previous':200C 'prior':268C 'process':93B,676C 'product':638C 'product-law':637C 'proof':462C 'prune':133C,383C,489C,566C,627C 'q7mm':209C 'quadrat':5A,45B,104C 'quadratic-complex':4A,103C 'quotedpath':348C,357C 'reduc':324C 'releas':262C,269C,289C 'remov':420C 'reopen':389C 'repeat':493C 'repo':535C 'repositori':227C 'reproduct':467C 'requir':212C,497C 'rescan':123C,423C 'rest':433C 'return':517C 'rough':62B 'rout':323C 'same-nam':581C,603C 'scan':337C,382C 'second':69B,163C,524C,667C,671C 'section':185C 'self':35B,565C 'self-host':34B 'self-prun':564C 'separ':194C 'servic':96B,111C 'set':127C,175C,448C,622C 'set.prototype.foreach':437C 'shape':172C,686C 'sharpest':466C 'simpli':410C 'sinc':485C 'singl':661C 'single-thread':660C 'size':449C,539C,613C 'stack':203C 'stack-overflow':202C 'stall':91B 'standard':679C 'string':85B,303C,630C 'structur':313C 'subsequ':428C 'summari':97C 'suppli':302C 'synchron':664C 'tabl':13A,54B,117C,184C,320C,416C,479C 'tag':250C 'take':44B,66B,161C,522C 'ten':669C 'thread':662C 'time':46B,529C,540C 'toml':2A,28A,37B,39B,84B,171C,225C,496C,498C 'toml-nod':1A 'toml.parse':16A,43B,98C,293C,525C 'top':371C,406C,577C,689C 'top-level':370C,405C,576C,688C 'total':456C 'trigger':684C 'two':124C,334C 'unbound':621C 'uncondit':445C 'uncontest':680C 'unpatch':195C 'unrel':134C,275C,404C,470C,548C,575C 'v5.0.0':249C,259C,277C 'valid':314C 'valueassign':365C 'valueassignments.delete':358C 'valueassignments.foreach':351C 'vari':641C 'variant':536C,649C 'verifi':265C 'version':223C 'via':8A,112C,391C 'vulner':100C 'w7c3':23A 'w9cf':210C 'well':291C 'without':132C 'work':149C,457C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4qx8-w7c3-pj3p","url":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","severity":"high","published_at":"2026-10-22T16:38:44+00:00","modified_at":"2026-10-22T16:38:47+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","severity":null,"published_at":"2026-10-21T21:17:56+00:00","modified_at":"2026-10-23T22:16:56+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}