{"id":"ghsa-ghsa-9j65-hcg3-gc64","seq":309567,"kind":"advisory","title":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","url":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9j65-hcg3-gc64","summary":"影響: npm:toml <= 5.0.0 → 5.0.1\ntoml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-114143"],"tags":["GHSA-9j65-hcg3-gc64","toml"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:38:06.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}