# CVE-2026-114143: toml-node TOML parser ReDoS in dotted key processing

Source: https://junglewise.ai/threats/cve-2026-114143-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114143 · Severity: high · CVSS 4 · Published 2026-10-21

toml-node is a JavaScript library that parses TOML configuration files for Node.js and browser applications. A flaw in how it processes deeply nested dotted keys causes it to perform redundant work exponentially, blocking the event loop for seconds and potentially crashing the process through memory exhaustion when parsing specially crafted TOML files.

Technologies: [BinaryMuse Toml-Node](https://junglewise.ai/threats/technologies/toml-node), [toml (npm)](https://junglewise.ai/threats/technologies/toml). Vendors: [BinaryMuse](https://junglewise.ai/threats/vendors/binarymuse), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-114143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114143 being exploited in the wild.

**How severe is CVE-2026-114143?** High severity, with a CVSS score of 4, published 21 October 2026.

**Which products and versions are affected?** BinaryMuse Toml-Node before 5.0.1; toml (npm) <= 5.0.0, SEMVER:introduced=0,fixed=5.0.1.

**Is there a fix for CVE-2026-114143?** Yes. toml (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114143 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114143?** Check whether you run BinaryMuse Toml-Node or toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toml (npm): upgrade to 5.0.1 or later

  ```sh
  npm install toml@5.0.1
  ```


## Technical details

The vulnerability is a quadratic-time algorithm flaw in the compiler.js file's path processing functions (assign(), deepRef(), setNestedKey()). When handling long dotted keys and various table/array-of-tables headers, the code repeatedly slices and rejoins entire path prefixes, causing O(n²) behavior. An attacker can provide malicious TOML input with deeply nested dotted keys to trigger event loop blocking or out-of-memory termination; the maxDepth option does not mitigate this since it limits recursion depth, not key-segment count.

## Affected products

- BinaryMuse toml-node before 5.0.1

## Identifiers

- CVE-2026-114143
- GHSA-9j65-hcg3-gc64

## Timeline

- 2026-10-21: disclosed: CVE-2026-114143 published
- 2026-10-12: patched: Fix committed

## References

- [https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606](https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606)
- [https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1](https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1)

## Related threats

- [toml-node denial of service in integer parsing](https://junglewise.ai/threats/cve-2026-114144-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node TOML parser prototype pollution in quoteDottedString](https://junglewise.ai/threats/cve-2026-114142-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node ReDoS in TOML parser array-of-tables header processing](https://junglewise.ai/threats/cve-2026-114141-toml-node-is-a-toml-parser-for-node-js-and-the-browser-prior-to)
- [toml-node uncontrolled recursion in parser](https://junglewise.ai/threats/cve-2026-77465-toml-node-uncontrolled-recursion-in-parser)
- [npm toml prototype pollution via __proto__ desynchronization](https://junglewise.ai/threats/cve-2026-63376-npm-toml-prototype-pollution-via-proto-desynchronization)