CyberRota Analysis
AI-GeneratedThe toml-node library, used for parsing TOML documents in Node.js and browsers, is vulnerable to a denial-of-service attack due to unbounded recursion in its parsing functions, which can lead to a stack overflow when processing deeply nested arrays or inline tables. This vulnerability can cause a remote unauthenticated attacker to crash the application by sending a specially crafted TOML document. Organizations utilizing versions prior to 4.2.0 should prioritize updating to mitigate potential disruptions in service.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.