CVE-2026-77465

Received Received - Intake

Stack Overflow in toml-node TOML Parser

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-77465

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability affects toml-node, a TOML parser for Node.js and browsers. It allows a remote attacker to crash the application by providing a TOML document with deeply nested arrays or inline tables. The parser's recursive functions lack a depth limit, causing a stack overflow and terminating the process.

Detection Guidance

This vulnerability can be detected by checking the version of toml-node in use. If your application uses toml-node and the version is below 4.2.0, it is vulnerable. Commands like 'npm list toml-node' or checking package.json can help identify the version.

Impact Analysis

If you use an unpatched version of toml-node, an attacker could send a malicious TOML file to crash your application. This could lead to denial of service, disrupting services that rely on the parser. Upgrading to version 4.2.0 or later fixes the issue.

Mitigation Strategies

Immediately update toml-node to version 4.2.0 or later. If updating is not possible, consider removing or replacing the library with a patched alternative. Ensure your Node.js application has proper error handling to prevent unexpected crashes from unhandled RangeError exceptions.

Hi! I’m here to help you understand CVE-2026-77465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70