Executive brief
The toml package, a widely-used Node.js TOML configuration file parser with ~47 million monthly downloads, crashes when parsing deeply nested arrays or inline tables. An attacker can send a small malicious TOML document (~5–6 KB) containing thousands of nested brackets to crash the entire parsing process, causing denial of service to any application that accepts user-supplied TOML input, such as configuration upload endpoints or APIs.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) in the Peggy-generated recursive-descent parser (lib/parser.js). The parser's value rule mutually recurses with array and inline_table rules without depth tracking: peg$parsevalue() calls peg$parsearray(), which calls peg$parsevalue() back, and similarly for inline tables via peg$parseinline_table_entry(). A deeply nested TOML input (e.g., a=[[[…]]]) causes call stack exhaustion and throws a RangeError. An attacker sends a ~6 KB TOML payload with 2,500–3,000 levels of nesting via a network request (e.g., HTTP POST to a /config endpoint). The RangeError bypasses typical parse-error handlers (which expect SyntaxError) and propagates as an uncaught exception, crashing the worker process. No authentication or user interaction is required; the fix is available in version 4.2.0 (add input validation or grammar-level depth guards).
Affected products
- BinaryMuse toml < 4.2.0
Timeline
- 2026-07-13: disclosed: Published as GitHub Advisory (first published)
- 2026-09-03: advisory: GitHub Advisory updated
- 2026-07-13: patched: Fixed in version 4.2.0