CVE-2026-63386
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The issue does not affect confidentiality or integrity and is fixed in version 1.1.3.
Risk Assessment
An attacker can supply crafted TOML that exhausts the stack and terminates a worker process, causing denial of service. The risk applies to applications parsing untrusted TOML that handle only SyntaxParseError.
Recommendation
Update js-toml to version 1.1.3 or later and extend exception handling to cover RangeError and other unexpected errors.
Other vulnerabilities in js-toml
See all- CVE-2026-50029Medium
js-toml, a TOML parser for JavaScript, before version 1.1.2 contains a vulnerability due to incorrect duplicate key checking. Instead of checking `if (key in object)`, it uses `if (object[key])`, causing that when the previous value is falsy (e.g., `false`, `0`, `""`), the duplicate key branch is skipped and the value is silently overwritten. This leads to structural type confusion in the returned object.
- CVE-2026-49293High
js-toml up to and including 1.1.1 parses hex/octal/binary integer literals in an O(n²) loop with no upper bound on literal length. A single TOML document with a ~500 kB hex literal pins one CPU core for ~40 seconds, enabling a CPU exhaustion DoS.
Original NVD description (English source)
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The exception is synchronous and catchable by consumers that handle all exceptions, and the issue does not affect confidentiality or integrity. This issue is fixed in version 1.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS