Description

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T21:17:21.803Z",
  "pubdate": "2026-09-03T21:17:21.803Z",
  "executiveSummary": "The toml-node library is vulnerable to a stack exhaustion vulnerability caused by an unbounded recursive-descent parser. This issue allows a remote, unauthenticated attacker to trigger a denial-of-service (DoS) condition by supplying a specially crafted, deeply nested TOML document.\nThe vulnerability originates in the Peggy 5.1.0 generated parser logic, which lacks depth validation for nested structures such as arrays and inline tables. When processing such inputs, the JavaScript call stack exceeds its capacity, resulting in an unhandled RangeError that forces the termination of the Node.js process or worker thread.\nGiven that parsing is a fundamental operation in many applications, this vulnerability poses a significant risk to the availability of systems relying on toml-node for processing user-supplied configuration data or metadata. Exploitation requires no authentication and can be performed remotely by submitting a malicious TOML payload. The lack of proper depth limiting in the grammar allows attackers to reliably crash application instances with minimal resources.",
  "technicalDetails": "The vulnerability exists in the lib/parser.js file within the toml-node library, specifically within the Peggy 5.1.0 generated parsing functions: peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry. These functions implement a recursive-descent approach to traverse the hierarchical structure of a TOML document without enforcing a maximum recursion depth.\nThe root cause is the absence of an internal safety mechanism to bound the recursion depth during the tokenization and parsing phase of nested structures. When the parser encounters deeply nested arrays or inline tables, it pushes new frames onto the Node.js call stack for each level of nesting. In JavaScript environments, the call stack has a finite size, typically defined by the engine's memory limits.\nAn attacker can exploit this by crafting a payload containing thousands of nested arrays (e.g., [[[[[[...]]]]]]) or inline tables. As the parser recursively invokes the aforementioned functions to resolve these nested elements, the process consumes excessive stack space. Once the stack limit is exceeded, the JavaScript engine throws a RangeError (Maximum call stack size exceeded).\nBecause the parser does not catch this specific condition, the error propagates to the top level, causing the application thread or the entire Node.js worker process to crash if the exception is not explicitly handled by the host application. This effectively results in a remote Denial of Service (DoS).\nThe attack flow is as follows: 1) The attacker identifies an endpoint in a target application that uses toml-node to parse arbitrary or user-controllable TOML input. 2) The attacker submits a malformed TOML payload characterized by deep nesting structures. 3) The target application passes the input to toml.parse(). 4) The recursive functions in lib/parser.js begin parsing, rapidly exhausting the execution stack. 5) The Node.js runtime throws a RangeError, leading to a crash and service unavailability.\nThis vulnerability affects toml-node versions prior to 4.2.0. The underlying grammar, defined in src/toml.pegjs, must be modified to include depth constraints or a stack-depth check to prevent uncontrolled recursion. The patch in version 4.2.0 implements the necessary bounds checking to mitigate this exploitation vector."
}