toml (npm): Three high-severity CPU DoS vulnerabilities in toml.parse() allow event-loop blocking via crafted TOML documents (CVE-2026-114144, CVE-2026-114143)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-114141, CVE-2026-114143, CVE-2026-114144
Three coordinated advisories published Oct 22, 2026 describe denial-of-service flaws in the toml npm package (<= 5.0.0), all fixed in 5.0.1. CVE-2026-114144: unbounded-length integer literals are passed to BigInt() before the 64-bit range check, so a ~5MB hex/decimal literal burns ~6s of CPU. CVE-2026-114143: quadratic O(n²) work in assign(), deepRef(), and setNestedKey() when recomputing dotted-key path prefixes; a ~100KB dotted key hangs for ~6.8s and ~200KB crashes the process with OOM. A third advisory describes quadratic rescans in addTableArray() for many [[name]] headers (~10.3s for a 321KB document). All paths synchronously block the Node.js event loop, stalling every request in the process. Any service parsing attacker-supplied TOML (config uploads, CI/CD, linters, editors) is exposed. Public PoCs exist; no in-the-wild exploitation reported. Fix: upgrade to toml 5.0.1.
What to do
- Upgrade toml to 5.0.1 or later immediately (npm audit / lockfile update)
- Audit dependencies for anything that calls toml.parse() on untrusted or third-party input (config upload endpoints, CI/CD pipelines, linters, editors/language servers)
- Until patched, add input-size limits and timeouts around TOML parsing, or run parsing in an isolated worker/child process so the main event loop is not blocked
- Monitor for signs of DoS attempts: long CPU spikes correlated with TOML-parsing requests
Fixed versions
Sources
All live incidents on Threat Watch
