Vulnerabilities

toml-node is a TOML parser for Node.js and the browser.

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

Node.js

Fix

available

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114141 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 10d ago

   toml-node is a TOML parser for Node.js and the browser.

   CVSS 7.5 CVE-2026-114144 Node.js
2. 10
   CVE NVD 10d ago

   toml-node is a TOML parser for Node.js and the browser.

   Fix available CVE-2026-114143 Node.js
3. 10
   CVE NVD 10d ago

   toml-node is a TOML parser for Node.js and the browser.

   Fix available CVE-2026-114142 Node.js