Search/CVE-2026-114141
● CVE

CVE-2026-114141

DiscoveredOct 21, 2026UpdatedOct 23, 2026

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.

CVSS v3.1
—
EPSS
0.47%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Oct 23, 2026 → Oct 31, 2026
▲ 0.18pp
0.29% → 0.47% over 3 tracked changes
Connections
1 relationships
Timeline
disclosure → media coverage
Oct 21, 2026
Disclosure — published as a CVE record.