CVE-2026-77465

CVE-2026-77465 is an uncontrolled recursion flaw (CWE-674) in toml-node, a TOML parser for Node.js and the browser: the Peggy 5.1.0-generated recursive-descent parser in lib/parser.js recurses through nested arrays and inline tables (peg$parsevalue, peg$parsearray, peg$parseinline_table_entry) with no depth limit. A remote, unauthenticated attacker who can make an application parse an attacker-controlled TOML document — for example via an API endpoint, uploaded config, or message body — can include a few thousand nested arrays or inline tables to exhaust the Node.js call stack. The failure surfaces as an unexpected RangeError instead of the parser's normal SyntaxError, which can terminate an unprotected request worker or the entire process, resulting in denial of service (no confidentiality or integrity impact). Any application or service running toml-node prior to version 4.2.0 to parse untrusted TOML is affected; the fix is in version 4.2.0. There is currently no known exploitation, no public proof-of-concept, and no CISA KEV listing, with EPSS estimating roughly a 0.4% chance of exploitation within 30 days.

What to do: Upgrade to toml-node 4.2.0 or later (update the "toml" npm dependency, including transitive usage — check with npm ls toml). As interim mitigation, pre-validate or cap the nesting depth of untrusted TOML input before calling toml.parse(), and run parsing in an isolated worker so a RangeError-driven crash cannot take down the main process or request worker.