toml-node EUVD-2026-107552

Exploitation requires the application to pass attacker-controlled or untrusted TOML text to toml-node's toml.parse() while running a version prior to 5.0.1; the malicious document must contain a large number of distinct array-of-tables ([[name]]) headers to trigger the quadratic work in addTableArray(). Limiting factors: the impact is confined to availability (event-loop/process stall) with no data exposure or code execution, and deployments that only parse trusted, static, operator-controlled TOML configuration are not realistically exposed. No authentication is required (PR:N) and no user interaction is needed, so any reachable parsing path on untrusted input is sufficient.

This is a denial-of-service (availability-only) flaw: the vendor CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores remote, low-complexity, unauthenticated exploitation with VA:H but VC:N/VI:N - no confidentiality or integrity impact - consistent with CWE-407 (inefficient algorithmic complexity) and the description's quadratic event-loop blocking. The 8.7 score is high because availability loss is weighted heavily under CVSS 4.0, but the real-world blast radius is narrower than a code-execution bug of similar score: the worst outcome is process/event-loop starvation, not compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not a confirmed in-the-wild threat. Note a metadata conflict: the input Tag 'Information Disclosure' directly contradicts the CVSS vector (VC:N) and the description, which describe pure availability impact with no data exposure - the tag appears mislabeled and should not drive triage. Realistic priority is moderate-but-conditional: it only matters where the library parses attacker-controlled TOML.

An application using toml-node < 5.0.1 accepts TOML from an untrusted source (e.g., an uploaded config, an API body, or user-supplied document) and calls toml.parse() on it. An attacker submits a document containing a very large number of distinct array-of-tables headers ([[a]], [[b]], ...), triggering quadratic rescans of the bookkeeping sets that synchronously block the Node.js event loop and stall all other work in the process. No public exploit code was identified, but the payload is trivial to construct.