Node.js TOML Parser Flaw Blocks Event Loop, Fix Available in 5.0.1

The toml-node library, a TOML parser for Node.js and browsers, contains a denial-of-service vulnerability in versions prior to 5.0.1. According to the National Vulnerability Database, this flaw allows an attacker to block the Node.js event loop. The vendor has released version 5.0.1, which fixes the issue.

How it unfolded

• The National Vulnerability Database published a record for CVE-2026-114141.
• The record identifies a weakness in the addTableArray() function within lib/compiler.js.
• The issue was resolved in the release of toml-node version 5.0.1.

Who is affected

Organizations using the BinaryMuse toml-node library in versions earlier than 5.0.1 are affected. This includes applications running on Node.js and those operating in browser environments that rely on this specific parser. The vulnerability is classified under CWE-407, which relates to unreliable resource handling. The flaw exists in the compiler's addTableArray() function located in the lib/compiler.js file.

Our take on the response

The vendor addressed the issue by releasing version 5.0.1. The National Vulnerability Database rates the severity as High, with a CVSS score of 8.7. This score reflects the impact of blocking the event loop. The fix removes the inefficient rescanning behavior that caused the denial-of-service condition.

Who needs to act first

Managed service providers should prioritize systems that accept untrusted TOML input from external users. Teams usually assess exposure by checking if the parser handles data from public APIs or user uploads. Before rolling out updates, verify compatibility with existing application logic. Back up current configurations to allow quick rollback if issues arise. Monitor server logs for signs of increased latency or frozen processes, which may indicate exploitation attempts.

What to do and how to stay safe: toml-node

• Verify if your applications use toml-node versions prior to 5.0.1.
• Update the library to version 5.0.1 or later once tested.
• Monitor Node.js event loop latency for unusual spikes.
• Restrict input size for TOML files parsed from untrusted sources.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is identified as CVE-2026-114141.

Which versions of toml-node are affected?

Versions prior to 5.0.1 are affected by this flaw.

Is there a fix available?

Yes, the issue is fixed in version 5.0.1.