{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abinarymusetoml-nodenode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:binarymuse:toml-node:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-114143"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["toml-node (\u003c= 5.0.0)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","javascript","nodejs","supply-chain"],"_cs_type":"advisory","_cs_vendors":["BinaryMuse"],"content_html":"\u003cp\u003eThe \u003ccode\u003etoml-node\u003c/code\u003e library (npm package \u003ccode\u003etoml\u003c/code\u003e) is vulnerable to a quadratic-complexity (O(n²)) denial-of-service (DoS) via long dotted keys, table headers, or inline-table keys. The library repeatedly recomputes the full path-prefix string during parsing, with no limits on segment count or total input length. This vulnerability is not mitigated by the existing \u003ccode\u003emaxDepth\u003c/code\u003e option and affects \u003ccode\u003eassign()\u003c/code\u003e, \u003ccode\u003edeepRef()\u003c/code\u003e, and \u003ccode\u003esetNestedKey()\u003c/code\u003e functions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEvent Loop Blocking:\u003c/strong\u003e A ~100KB payload induces a multi-second synchronous hang, stalling the entire Node.js event loop.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcess Crash:\u003c/strong\u003e A ~200KB payload causes a fatal \u003ccode\u003eJavaScript heap out of memory\u003c/code\u003e error, terminating the Node.js process.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnauthenticated Access:\u003c/strong\u003e Exploitation requires only that the target application parses a user-controlled TOML input (e.g., config uploads or API request bodies).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade or apply patches to \u003ccode\u003etoml-node\u003c/code\u003e as they become available.\u003c/li\u003e\n\u003cli\u003eIf a patch is unavailable, implement a pre-parsing input size limit (e.g., rejecting TOML documents exceeding a reasonable size such as 10KB) to prevent the O(n²) trigger.\u003c/li\u003e\n\u003cli\u003eImplement length validation on key segments for any TOML data processed by the library.\u003c/li\u003e\n\u003cli\u003eMigrate away from \u003ccode\u003etoml-node\u003c/code\u003e if the library is not actively maintained to address these structural vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T12:31:24Z","date_published":"2026-10-29T12:31:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-toml-node-dos-218678a9/","summary":"The toml-node library is vulnerable to a quadratic-complexity denial-of-service attack, where long dotted keys in TOML documents cause CPU exhaustion or process crashes via memory depletion.","title":"BinaryMuse toml-node: Quadratic-complexity denial-of-service (CVE-2026-114143)","url":"https://feed.craftedsignal.io/briefs/2026-10-toml-node-dos-218678a9/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:binarymuse:toml-Node:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}