# CVE-2026-114141: toml-node ReDoS in TOML parser array-of-tables header processing

Source: https://junglewise.ai/threats/cve-2026-114141-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114141 · Severity: high · CVSS 4 · Published 2026-10-21

toml-node is a TOML configuration file parser used in Node.js and browser applications. A malicious TOML document with many array-of-tables headers can cause the parser to perform quadratic work, blocking the JavaScript event loop and denying service to other operations. Applications parsing untrusted TOML input are vulnerable to denial of service.

Technologies: [BinaryMuse Toml-Node](https://junglewise.ai/threats/technologies/toml-node), [toml (npm)](https://junglewise.ai/threats/technologies/toml). Vendors: [BinaryMuse](https://junglewise.ai/threats/vendors/binarymuse), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-114141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114141 being exploited in the wild.

**How severe is CVE-2026-114141?** High severity, with a CVSS score of 4, published 21 October 2026.

**Which products and versions are affected?** BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.

**Is there a fix for CVE-2026-114141?** Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114141 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114141?** Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toml (npm): upgrade to 5.0.1 or later

  ```sh
  npm install toml@5.0.1
  ```


## Technical details

The toml.parse() function's addTableArray() method rescans all previously assigned paths and values for each new array-of-tables header without pruning distinct paths, leading to O(n²) synchronous execution. An attacker can craft a TOML document with many [[name]] headers to trigger this algorithmic complexity, blocking the event loop. The fix refactors path tracking to use a WeakMap-based tagging system instead of string-keyed sets, eliminating the rescan.

## Affected products

- BinaryMuse toml-node before 5.0.1

## Identifiers

- CVE-2026-114141
- GHSA-4qx8-w7c3-pj3p

## Timeline

- 2026-10-21: disclosed
- 2026-10-12: patched

## References

- [https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606](https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606)
- [https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1](https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1)

## Related threats

- [toml-node denial of service in integer parsing](https://junglewise.ai/threats/cve-2026-114144-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node TOML parser ReDoS in dotted key processing](https://junglewise.ai/threats/cve-2026-114143-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node TOML parser prototype pollution in quoteDottedString](https://junglewise.ai/threats/cve-2026-114142-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node uncontrolled recursion in parser](https://junglewise.ai/threats/cve-2026-77465-toml-node-uncontrolled-recursion-in-parser)
- [npm toml prototype pollution via __proto__ desynchronization](https://junglewise.ai/threats/cve-2026-63376-npm-toml-prototype-pollution-via-proto-desynchronization)