BinaryMuse toml-node up to 4.1.x TOML Parser lib/parser.js toml.parse stack-based overflow

Summaryinfo

A vulnerability was found in BinaryMuse toml-node up to 4.1.x. It has been declared as problematic. This issue affects the function toml.parse of the file lib/parser.js of the component TOML Parser. Such manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2026-77465. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in BinaryMuse toml-node up to 4.1.x. It has been rated as problematic. Affected by this issue is the function toml.parse of the file lib/parser.js of the component TOML Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-77465 since 08/20/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-70739). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• BinaryMuse

Name

• toml-node

Version

• 4.0
• 4.1

Website

• Product: https://github.com/BinaryMuse/toml-node/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion