CVE-2026-114141 BinaryMuse CVE debrief

Who should care

Defenders responsible for systems that parse TOML files from untrusted sources should assess exposure and prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability managers, and security teams who handle TOML file parsing.

Why it matters

Defenders should care about this vulnerability because it can lead to denial-of-service (DoS) attacks and increased parsing time for large TOML files, potentially impacting system performance. The vulnerability is present in version 5.0.0 and earlier of the toml-node package, and has been fixed in version 5.0.1.

• Potential for denial-of-service (DoS) attacks
• Increased parsing time for large TOML files
• Possible impact on system performance

Technical summary

The toml.parse() function in toml-node is vulnerable to a quadratic-complexity denial-of-service (DoS) attack via many array-of-tables headers. This is caused by the addTableArray() function in lib/compiler.js, which rescans two entire bookkeeping Sets on every array-of-tables header without pruning unrelated or distinct entries. A document containing n such headers costs O(n²) compiler work. For example, a ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections), not a contrived edge case.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that parse TOML files from untrusted sources.

Recommended defensive actions

• Patch to version 5.0.1 or later
• Mitigate by limiting the number of array-of-tables headers in TOML files
• Monitor for suspicious TOML parsing activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the addTableArray() function in lib/compiler.js, which rescans two entire bookkeeping Sets on every array-of-tables header without pruning unrelated or distinct entries. A document containing n such headers costs O(n²) compiler work. For example, a ~321KB document of 20,000 distinct-named [[name]] blocks takes ~10.3 seconds to parse. This issue is separate from the previously fixed stack-overflow DoS (GHSA-82x6-q7mm-w9cf) and requires no key nesting or dotted keys at all.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.