CVE-2026-114143: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single
long dotted key, table header, or inline-table key. A ~100KB crafted document causes a
multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an
uncatchable out-of-memory error. This is a separate, unpatched code path from the previously
fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at
all, and is confirmed unaffected by the maxDepth option that fixed that earlier issue.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-114143 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →