toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

影響: npm:toml <= 5.0.0 → 5.0.1

toml.parse() is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:38, GitHub Advisory Database에서 "toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-114143.