toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and
    rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-
    tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic
    work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the
    process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does
    not mitigate this path. This issue is fixed in version 5.0.1. (CVE-2026-114143)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and     rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-     tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic     work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the     process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does     not mitigate this path. This issue is fixed in version 5.0.1. (CVE-2026-114143)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476852	SCA: security update for toml (GHSA-9j65-hcg3-gc64)	Tenable Cloud Security	SCA Checks	Local	high
476852	SCA: security update for toml (GHSA-9j65-hcg3-gc64)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
370261	Linux Distros Unpatched Vulnerability : CVE-2026-114143	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-114143

high

Tenable Plugins

high

high

high