---
id: "CVE-2026-114141"
kind: "vulnerability"
aliases: ["CVE-2026-114141", "GHSA-4qx8-w7c3-pj3p"]
title: "toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()"
severity: "high"
cvss: 8.7
epss: 0.0029100000392645597
exploited: false
status: "open"
category: "package"
products: [{"name": "toml", "fixed": ["5.0.1"], "affected": "<= 5.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-407", "node.js", "npm", "package", "self-hosted", "toml"]
not_affected_if: ["managed-hosting-with-input-limits", "parses-only-trusted-input", "toml-not-used"]
published_at: "2026-10-21T21:17:56+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4qx8-w7c3-pj3p", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114141", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

The toml npm package's toml.parse() takes quadratic time on documents with many array-of-tables ([[name]]) headers with distinct names, so a roughly 321 KB input takes about 10 seconds to parse and blocks the Node.js event loop. An attacker who can get one TOML string parsed by an application can stall that process (denial of service).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:toml affected <= 5.0.0 fixed 5.0.1

## How to check

Run npm ls toml and check whether the resolved version is 5.0.0 or lower.
Search lock files (package-lock.json, yarn.lock, pnpm-lock.yaml) for "toml" at a version <= 5.0.0.
Find call sites with grep -rn "toml.parse\|require('toml')" on code that parses untrusted input.

## Fix

Upgrade the toml npm package to 5.0.1 or later.
Until then, limit the size of TOML input accepted from untrusted sources or parse it in a worker or child process with a timeout.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-4qx8-w7c3-pj3p
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114141

## From the sources

## Summary

`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many
array-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two
entire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct
entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document
of 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely
ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),
not a contrived edge case. This is a separate, unpatched code path from the previously fixed
stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.

## Affected component / version

- Package: `toml` (npm), repository `BinaryMuse/toml-node`
- Function: `addTableArray()` in `lib/compiler.js`
- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past
  the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.
  Not exhaustively verified against every prior release, but the affected function is
  unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely
  predates that release as well.

## Details

`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to
`parser.parse()` and then `compiler.compile()` with no length or structural validation. Every
`[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to
`addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every
call:

```js
assignedPaths.forEach(function(p) {
  if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);
});
valueAssignments.forEach(function(p) {
  if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);
});
```
(`lib/compiler.js:228-233`)

`assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/array path
ever assigned in the entire document. Each scan prunes only entries matching the *currently
reopened* path via `isSameOrSubPath()` (`lib/compiler.js:319-321`: `path === prefix ||
path.indexOf(prefix + ".") === 0`); anything else — an unrelated top-level key, or simply a
*different* array-of-tables name — is never removed and is rescanned in full on every
subsequent `[[name]]` header for the rest of the parse. `Set.prototype.forEach` has no early
exit, so this is unconditionally O(current Set size) on every call, giving O(n²) total work
for n such headers.

## Proof of Concept

The sharpest reproduction needs no unrelated keys at all — just N array-of-tables headers with
N *distinct* names, since nothing is ever pruned when no name repeats:

```js
const toml = require('toml');

function distinctArrayHeaders(n) {
  let out = '';
  for (let i = 0; i < n; i++) out += `[[a${i}]]\nv = 1\n`;
  return out;
}

// ~321 KB input -- takes ~10.3 seconds
toml.parse(distinctArrayHeaders(20000));
```

Measured timings (Node, direct execution against this repo):

| Variant | n | input size | time |
|---|---|---|---|
| N distinct-named `[[name]]` headers, no unrelated keys | 20,000 | 321 KB | 10.3 s |
| Same N with all-same-name headers (self-pruning, control) | 20,000 | 240 KB | 78 ms |
| M unrelated top-level keys + N same-name `[[name]]` headers | M=N=32,000 | 906 KB | 42.3 s |

The ~130x gap between the distinct-name and same-name cases at identical N and comparable
input size isolates the mechanism precisely: the bug is unbounded Set growth from never-pruned
entries, not string length or any other confound. A product-law check (varying M and N
independently in the mixed variant) further confirmed genuine O(M·N) complexity.

## Impact

Node.js is single-threaded — this synchronous, multi-second-to-tens-of-seconds compile blocks
the entire process event loop, standard uncontested Node.js behavior. The triggering document
shape — flat top-level config keys plus one or more array-of-tables sections (e.g. a `[db]`
settings block plus a `[[servers]]` list) — is unremarkable, common real-world TOML, not an
edge case. No authentication or special access is required; only the ability to get one TOML
string parsed by an application using this library.

## Suggested remediation

Avoid scanning the entire `assignedPaths`/`valueAssignments` Sets on every `[[name]]` header.
Index entries by their top-level path segment (e.g. a `Map<string, Set<string>>` keyed by the
first key component) so `addTableArray()` only ever scans the bucket relevant to the path
being reopened, in time proportional to that bucket's size rather than the whole document's
accumulated path count:

```js
var assignedByRoot = new Map(); // root segment -> Set<fullPath>

function addTableArray(node) {
  var path = node.value;
  var root = path[0];
  var bucket = assignedByRoot.get(root) || new Set();
  bucket.forEach(function(p) {
    if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);
  });
  // ...rest of addTableArray unchanged, reading/writing the per-root bucket
  // instead of the global assignedPaths/valueAssignments Sets
}
```

As with the sibling finding, an input-size or table-count limit would also help as
defense-in-depth.

## Credit

Discovered and reported by SecDim Security Research
secdim.com | @secdim | security@secdim.com

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_