BinaryMuse toml-node: Quadratic-complexity denial-of-service (CVE-2026-114143)

The toml-node library (npm package toml) is vulnerable to a quadratic-complexity (O(n²)) denial-of-service (DoS) via long dotted keys, table headers, or inline-table keys. The library repeatedly recomputes the full path-prefix string during parsing, with no limits on segment count or total input length. This vulnerability is not mitigated by the existing maxDepth option and affects assign(), deepRef(), and setNestedKey() functions.

Impact

• Event Loop Blocking: A ~100KB payload induces a multi-second synchronous hang, stalling the entire Node.js event loop.
• Process Crash: A ~200KB payload causes a fatal JavaScript heap out of memory error, terminating the Node.js process.
• Unauthenticated Access: Exploitation requires only that the target application parses a user-controlled TOML input (e.g., config uploads or API request bodies).

Recommendation

• Upgrade or apply patches to toml-node as they become available.
• If a patch is unavailable, implement a pre-parsing input size limit (e.g., rejecting TOML documents exceeding a reasonable size such as 10KB) to prevent the O(n²) trigger.
• Implement length validation on key segments for any TOML data processed by the library.
• Migrate away from toml-node if the library is not actively maintained to address these structural vulnerabilities.