CVE-2026-114144 BinaryMuse CVE debrief

Who should care

Defenders responsible for Node.js applications that parse TOML documents, especially those that handle attacker-supplied or third-party TOML, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-114144 is a denial-of-service vulnerability in the toml-node package that can be exploited by parsing a specially crafted TOML document. Defenders should prioritize patching or mitigating this vulnerability, especially in applications that parse attacker-supplied or third-party TOML.

• Denial-of-service condition due to excessive CPU consumption
• Potential for exploitation without authentication or complex crafting
• Need for patching or mitigation to prevent exploitation

Technical summary

The `toml.parse()` function in the toml-node package is vulnerable to an uncontrolled resource consumption attack. When parsing a TOML document containing a long integer literal, the function can consume excessive CPU resources, leading to a denial-of-service condition. The parser does enforce a nesting-depth limit (`MAX_DEPTH`, default 500) to guard against stack overflow from deeply nested arrays/inline tables. However, it does not bound the length of the digit sequence when converting integer literals to `BigInt`. This can lead to a denial-of-service condition when parsing a specially crafted TOML document.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in applications that parse attacker-supplied or third-party TOML.

Recommended defensive actions

• Patch to version 5.0.1 or later
• Restrict access to TOML parsing to trusted sources
• Implement input validation and sanitization for TOML documents
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is caused by the `toml.parse()` function converting integer literals to `BigInt` without bounding the length of the digit sequence. This can lead to a denial-of-service condition when parsing a specially crafted TOML document.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.