toml-node CVE-2026-77465

Exploitation requires only that the target application calls toml.parse() on data supplied or influenced by the attacker - for example, a REST API that accepts a TOML-formatted request body, a CLI tool that reads user-provided TOML config files, or a build tool that processes workspace manifests. No authentication, no special configuration, and no prior access to the system is required beyond the ability to deliver a crafted TOML document to the parsing call. Exploitation is limited to: (1) applications that accept TOML input from untrusted sources, and (2) Node.js environments running any toml version before 4.2.0. Applications that only ever parse TOML from trusted, internally authored configuration files are not exploitable. The attack payload is reliable on any default Node.js call-stack configuration and does not depend on OS, architecture, or deployment mode.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterises this as a network-reachable, low-complexity, unauthenticated denial-of-service with no confidentiality or integrity impact. The primary limiting factor is that exploitation requires the application to pass attacker-controlled data to toml.parse() - not all Node.js applications accept TOML from untrusted sources. However, for those that do (configuration loaders, API gateways accepting TOML bodies, build tooling accepting user-supplied manifests), the attack is trivially automated: a single ~5-6 KB request payload reliably terminates the process on any Node.js version with default stack size. A confirmed PoC is documented in the GHSA advisory. The package's ~47 million monthly downloads represents an unusually broad exposure surface. No CISA KEV listing and no EPSS data are provided, so exploitation prevalence in the wild is unconfirmed. The combination of public PoC, zero prerequisites beyond network access to a parsing endpoint, and extremely wide deployment footprint makes this a genuine priority for any application that parses external TOML.

An attacker sends a single HTTP POST request containing a TOML body with several thousand nested empty arrays (e.g., a=[[[[[...]]]]]]) totalling about 5-6 KB to any endpoint that calls toml.parse() on the request body. The recursive-descent parser exhausts the Node.js call stack and raises an uncatchable RangeError, crashing the request worker or the entire process. A confirmed PoC demonstrating this on toml 4.1.2 and Node.js v24.16.0 is documented in the GHSA advisory.