CVE-2026-77465High· 7.5▾ Twilighttoml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions r…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
7.5 → 3.5
high → low
3.5 → 7.5
low → high
7.5 → 3.5
high → low
3.5 → 7.5
low → high
7.5 → 3.5
high → low
3.5 → 7.5
low → high
0.4% → 0.6%
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
toml < 4.2.0Patched in:
toml 4.2.0Source: https://github.com/advisories/GHSA-82x6-q7mm-w9cf
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111767High· 8.6@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore (CVE-2026-111767)
CVE-2026-110249Medium· 5.3A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours
CVE-2026-53655Medium· 6.1node-tar: node-tar: File smuggling due to inconsistent tar archive parsing (CVE-2026-53655)
CVE-2026-97631High· 8.8edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-98869High· 7.8kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)