CVE-2026-114143 BinaryMuse CVE debrief

Who should care

Node.js developers and administrators using the `toml` package should assess their exposure and prioritize updating to version 5.0.1 or later. This vulnerability can lead to denial-of-service conditions, impacting application availability and performance.

Why it matters

Defenders should care about CVE-2026-114143 because it allows for a quadratic-complexity denial-of-service (DoS) attack via long dotted keys or table paths in the `toml.parse()` function of the `toml` package for Node.js. This vulnerability can impact Node.js applications using the `toml` package, potentially leading to denial-of-service conditions. The vulnerability is confirmed in version `5.0.0` and earlier, with a fix available in version `5.0.1`.

• Denial-of-service (DoS) via long dotted keys or table paths
• Potential for multi-second synchronous hangs or out-of-memory errors

Technical summary

The `toml.parse()` function in the `toml` package for Node.js is vulnerable to a quadratic-complexity denial-of-service (DoS) attack via long dotted keys or table paths. A crafted document of approximately 100KB can cause a multi-second synchronous hang, while a document of about 200KB can crash the Node.js process with an uncatchable out-of-memory error. This issue is separate from a previously fixed stack-overflow DoS and is not mitigated by the `maxDepth` option. The vulnerability is confirmed in version `5.0.0` and earlier, with a fix available in version `5.0.1`. Affected functions include `assign()`, `deepRef()`, and `setNestedKey()` in `lib/compiler.js`. Node.js developers and administrators using the `T

Defensive priority

Defenders should prioritize updating to version 5.0.1 or later of the `toml` package to mitigate this vulnerability. Node.js applications using the `toml` package should assess their exposure and verify that their TOML parsing does not use vulnerable functions.

Recommended defensive actions

• Update to version 5.0.1 or later of the `toml` package.
• Assess exposure in Node.js applications using the `toml` package.
• Verify that TOML parsing does not use vulnerable functions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past the `v5.0.0` tag. The affected functions are `assign()`, `deepRef()`, and `setNestedKey()` in `lib/compiler.js`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.