A vulnerability in the toml-node package allows for prototype pollution when parsing a TOML document, which can write to Object.prototype and affect every object in the process. The vulnerability arises from ambiguous path-key encoding and a missing owned-container check. This issue can lead to unintended property modifications to Object.prototype, potentially impacting system stability and security. Defe [truncated]
The toml-node package, specifically the toml.parse() function, is vulnerable to a quadratic-complexity denial-of-service (DoS) attack via many array-of-tables headers. This issue is present in version 5.0.0 and earlier, and has been fixed in version 5.0.1. The vulnerability is caused by the addTableArray() function in lib/compiler.js, which rescans two entire bookkeeping Sets on every array-of-tables head [truncated]
A vulnerability in the `toml` package for Node.js, specifically in the `toml.parse()` function, allows for a quadratic-complexity denial-of-service (DoS) attack via long dotted keys or table paths. This issue is separate from a previously fixed stack-overflow DoS and is not mitigated by the `maxDepth` option. The vulnerability is confirmed in version `5.0.0` and earlier, with a fix available in version `5.0.1`.
A denial-of-service vulnerability exists in the toml-node package, specifically in the `toml.parse()` function, which can be exploited by parsing a specially crafted TOML document containing a long integer literal. This can cause a Node.js process to consume excessive CPU resources, leading to a denial-of-service condition. The vulnerability is caused by the `toml.parse()` function converting integer lite [truncated]
