js-toml vulnerabilities

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The issue does not affect confidentiality or integrity and is fixed in version 1.1.3.

js-toml, a TOML parser for JavaScript, before version 1.1.2 contains a vulnerability due to incorrect duplicate key checking. Instead of checking `if (key in object)`, it uses `if (object[key])`, causing that when the previous value is falsy (e.g., `false`, `0`, `""`), the duplicate key branch is skipped and the value is silently overwritten. This leads to structural type confusion in the returned object.

js-toml up to and including 1.1.1 parses hex/octal/binary integer literals in an O(n²) loop with no upper bound on literal length. A single TOML document with a ~500 kB hex literal pins one CPU core for ~40 seconds, enabling a CPU exhaustion DoS.