CVE-2026-77465: CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service

#security #cve #cybersecurity

CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service

Vulnerability ID: CVE-2026-77465
CVSS Score: 7.5
Published: 2026-09-03

An uncontrolled recursion vulnerability (CWE-674) in the toml-node NPM package (published as toml) prior to version 4.2.0 allows unauthenticated remote attackers to trigger process-wide Denial of Service (DoS) crashes. By submitting TOML payloads with deep bracket or brace nesting, attackers exhaust the V8 runtime stack limit.

TL;DR

A stack exhaustion vulnerability in toml-node allows remote attackers to crash Node.js application servers by submitting deeply nested arrays or inline tables, triggering a process-terminating RangeError.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-674
Attack Vector: Network
CVSS Score: 7.5 (High)
EPSS Score: Not currently assigned
Impact: Denial of Service (DoS)
Exploit Status: Proof-of-concept
KEV Status: Not listed

Affected Systems

toml-node (NPM package 'toml')
toml-node: < 4.2.0 (Fixed in: 4.2.0)

Code Analysis

Commit: 967b8b0

Add depth bounds to array and inline table grammar rules in PEGjs file to prevent RangeError stack exhaustions.

Exploit Details

GitHub Security Advisory: Vulnerability disclosure and stack overflow details

Mitigation Strategies

Upgrade to version 4.2.0 or higher.
Set 'maxDepth' in parse options if customized limits are required.
Implement rate limiting or payload size limits on API endpoints parsing TOML.

Remediation Steps:

Open the target repository.
Execute 'npm install toml@4.2.0' to upgrade the package.
Verify that package-lock.json or yarn.lock reflects the updated version.
Deploy the change and monitor process logs for any RangeError instances.

References

Read the full report for CVE-2026-77465 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community