CVE-2026-114141

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two entire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document of 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections), not a contrived edge case. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all. ## Affected component / version - Package: `toml` (npm), repository `BinaryMuse/toml-node` - Function: `addTableArray()` in `lib/compiler.js` - Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release. Not exhaustively verified against every prior release, but the affected function is unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely predates that release as well. ## Details `toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to `parser.parse()` and then `compiler.compile()` with no length or structural validation. Every `[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to `addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every call: ```js assignedPaths.forEach(function(p) { if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p); }); valueAssignments.forEach(function(p) { if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p); }); ``` (`lib/compiler.js:228-233`) `assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/arr