toml-node EUVD-2026-107555

Exploitation requires that the application call toml.parse() on attacker-controlled TOML input and run the parse on the Node.js event loop (the default synchronous usage). The attacker-controlled document must contain long dotted keys, table headers, array-of-tables headers, or inline-table keys whose segment counts drive the quadratic path processing in assign()/deepRef()/setNestedKey(). The maxDepth option does NOT limit key-segment count and therefore does not mitigate this; nesting-depth limits provide no protection. Limiting factors: the vulnerability is inert if TOML input is trusted or operator-supplied (e.g., static config files shipped by the deployer rather than received from users), and impact is confined to availability - there is no data exposure or code execution. Affected versions are all releases prior to 5.0.1 of binarymuse/toml-node.

This is a genuine but bounded availability risk, not a high-confidence critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly characterizes an easily reachable, unauthenticated, no-interaction flaw, but the impact is strictly availability (VA:H; VC:N/VI:N - no confidentiality or integrity), consistent with the CWE-407 algorithmic-complexity (quadratic) root cause. The 8.7 score is inflated relative to real-world urgency because it reflects a single-vector DoS against a parsing library rather than code execution or data exposure. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation - only a vendor fix (GHSA-9j65-hcg3-gc64, commit 609c873, release v5.0.1). A notable inconsistency: the input Tags include 'Information Disclosure', which contradicts the CVSS vector (VC:N) and the description - this is a denial-of-service, not a disclosure issue, and should be disregarded. Real-world risk is highest for Node.js services that parse attacker-supplied TOML on the main event loop; it is low where TOML input is trusted or operator-supplied.

An attacker submits a crafted TOML document - through any endpoint or feature where a Node.js application parses untrusted TOML via toml.parse() - containing extremely long dotted keys or table/array-of-tables headers. The quadratic slice-and-rejoin work in lib/compiler.js stalls the event loop for seconds (degrading or hanging all concurrent requests) and, with sufficiently long paths, exhausts memory and crashes the process. No public exploit was identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.