Is CVE-2026-114143 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114143 being exploited in the wild.

How severe is CVE-2026-114143?

High severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.

Is there a fix for CVE-2026-114143?

Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114143 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114143?

Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114143: toml-node TOML parser ReDoS in dotted key processing

Q: Is there a fix for CVE-2026-114143?

Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114143 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114143?

Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114143 · Severity: high · CVSS 4 · Published 2026-10-21

toml-node is a JavaScript library that parses TOML configuration files for Node.js and browser applications. A flaw in how it processes deeply nested dotted keys causes it to perform redundant work exponentially, blocking the event loop for seconds and potentially crashing the process through memory exhaustion when parsing specially crafted TOML files.

Technologies: BinaryMuse Toml-Node, toml (npm). Vendors: BinaryMuse, npm.

Quick answers

Is CVE-2026-114143 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114143 being exploited in the wild.
How severe is CVE-2026-114143?: High severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.
Is there a fix for CVE-2026-114143?: Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114143 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114143?: Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toml (npm): upgrade to 5.0.1 or later
```
npm install toml@5.0.1
```

Technical details

The vulnerability is a quadratic-time algorithm flaw in the compiler.js file's path processing functions (assign(), deepRef(), setNestedKey()). When handling long dotted keys and various table/array-of-tables headers, the code repeatedly slices and rejoins entire path prefixes, causing O(n²) behavior. An attacker can provide malicious TOML input with deeply nested dotted keys to trigger event loop blocking or out-of-memory termination; the maxDepth option does not mitigate this since it limits recursion depth, not key-segment count.

Affected products

BinaryMuse toml-node before 5.0.1

Identifiers

CVE-2026-114143
GHSA-9j65-hcg3-gc64

Timeline

2026-10-21: disclosed: CVE-2026-114143 published
2026-10-12: patched: Fix committed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.