CVE-2026-114141

HighCVSS 8.7/10Last modified Oct 23, 2026

Description

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-407

Affected software

Vendor	Product	Versions
BinaryMuse	toml-node	< 5.0.1

References

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1141428.8toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prot CVE-2026-1141438.7toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/CVE-2026-1141447.5toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decima CVE-2026-1141457.5GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py ac CVE-2026-1141469.0Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-1141477.5Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141487.8Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.CVE-2026-1141497.5Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141505.9Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.CVE-2026-1141518.8Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-1141528.8Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-1141547.5Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.