js-toml CVE-2026-63386

Exploitation requires an application that (1) uses js-toml prior to 1.1.3, (2) passes attacker-controlled TOML input to load(), and (3) handles parse failures by catching only the documented SyntaxParseError rather than all exceptions. The attacker supplies deeply nested arrays, deeply nested inline tables, or a long dotted/table-header key exceeding the recursive parser's safe depth (the fix defaults the new bound to 100). The key limiting factor is condition (3): because the RangeError is synchronous and catchable, any consumer using a broad try/catch is unaffected, so the DoS only materializes in services with narrow SyntaxParseError-only error handling. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine but low-severity denial-of-service issue, correctly scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The CVSS signals are internally consistent: remote, low-complexity, no privileges or user interaction, availability-only impact (A:L). CWE-674 (uncontrolled recursion) matches the described unbounded recursive descent in parser.ts/interpreter.ts exhausting the V8 call stack. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - though the triviality of crafting deeply nested TOML makes a working PoC easy to produce. Crucially, the vendor advisory itself notes the thrown exception is synchronous and catchable: an application that catches all exceptions (not just SyntaxParseError) is unaffected, and the fix converts the RangeError into the documented SyntaxParseError. This is a real but minor hardening/robustness issue, not an urgent priority; realistic impact is limited to worker/process crashes in services that both parse attacker-controlled TOML and narrowly catch only SyntaxParseError. No confidentiality or integrity exposure exists.

An application uses js-toml's load() to parse TOML supplied by an untrusted client (e.g. an uploaded config or API payload) and its error handler catches only SyntaxParseError. An attacker submits a tiny TOML document with deeply nested arrays/inline tables or a very long dotted key, overflowing the V8 call stack and producing an uncaught RangeError that crashes the worker or process. No public exploit is identified, but the malicious input is trivial to construct.