Is CVE-2026-114141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114141 being exploited in the wild.

How severe is CVE-2026-114141?

High severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.

Is there a fix for CVE-2026-114141?

Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114141 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114141?

Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114141: toml-node ReDoS in TOML parser array-of-tables header processing

Q: Is there a fix for CVE-2026-114141?

Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114141 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114141?

Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114141 · Severity: high · CVSS 4 · Published 2026-10-21

toml-node is a TOML configuration file parser used in Node.js and browser applications. A malicious TOML document with many array-of-tables headers can cause the parser to perform quadratic work, blocking the JavaScript event loop and denying service to other operations. Applications parsing untrusted TOML input are vulnerable to denial of service.

Technologies: BinaryMuse Toml-Node, toml (npm). Vendors: BinaryMuse, npm.

Quick answers

Is CVE-2026-114141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114141 being exploited in the wild.
How severe is CVE-2026-114141?: High severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.
Is there a fix for CVE-2026-114141?: Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114141 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114141?: Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toml (npm): upgrade to 5.0.1 or later
```
npm install toml@5.0.1
```

Technical details

The toml.parse() function's addTableArray() method rescans all previously assigned paths and values for each new array-of-tables header without pruning distinct paths, leading to O(n²) synchronous execution. An attacker can craft a TOML document with many [[name]] headers to trigger this algorithmic complexity, blocking the event loop. The fix refactors path tracking to use a WeakMap-based tagging system instead of string-keyed sets, eliminating the rescan.

Affected products

BinaryMuse toml-node before 5.0.1

Identifiers

CVE-2026-114141
GHSA-4qx8-w7c3-pj3p

Timeline

2026-10-21: disclosed
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.