CVE-2026-114141

What it actually does

The addTableArray() function in lib/compiler.js performs a full rescan of assignedPaths and valueAssignments sets for every array-of-tables header without pruning distinct paths, resulting in quadratic synchronous CPU work that blocks the Node.js event loop.

Why it matters to the business

Services relying on the parser can experience sudden unavailability or degraded performance when processing untrusted TOML input, with rising exploit probability increasing exposure for applications handling configuration or data files.

How an attack unfolds

An attacker crafts a TOML document containing a large number of distinct [[array-of-tables]] headers and supplies it to toml.parse(); the quadratic bookkeeping scan consumes excessive CPU in a single synchronous operation, starving the event loop of other tasks until the parse completes or times out.

How to fix it

Upgrade toml-node to version 5.0.1 or later; after upgrade, validate that parsing performance remains linear for documents with many array-of-tables headers.

How to confirm the fix worked

Confirm the installed package version is at least 5.0.1; run a benchmark that parses a TOML file containing 10,000 distinct [[array-of-tables]] entries and verify completion time remains proportional to document size rather than quadratic.

Typical attack path

1. Generate a TOML document with thousands of unique [[name]] array-of-tables headers
2. Deliver the document to any endpoint or API that invokes toml.parse() on untrusted input
3. Trigger the quadratic rescan path in addTableArray() to saturate a single thread and block the event loop

How to detect it

Review application and system logs for unusually long synchronous execution times or high CPU during TOML parsing calls; correlate with inbound requests that carry TOML content.

What your security team should do

• Immediately upgrade all instances of toml-node to 5.0.1
• Add dependency scanning rules to enforce the minimum fixed version in build pipelines
• Implement input size or complexity limits on TOML parsing operations until patches are deployed
• Monitor Node.js event-loop lag metrics for sudden spikes during configuration or data ingestion