CVE-2026-114143

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-table key. A ~100KB crafted document causes a multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an uncatchable out-of-memory error. This is a separate, unpatched code path from the previously fixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at all, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue. ## Affected component / version - Package: `toml` (npm), repository `BinaryMuse/toml-node` - Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js` - Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release. Not exhaustively verified against every prior release, but the affected functions are unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely predates that release as well. ## Details `toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to `parser.parse()` and then `compiler.compile()` with no length or structural validation. Inside `lib/compiler.js`, three separate functions each walk a dotted key's segments in a `for` loop and, on **every** iteration, recompute the full path-prefix string from scratch: - `assign()` (lines 69-107, the sink at line 81): `var intermediatePath = makeFullPath(keys.slice(0, i + 1));` — reached for top-level dotted-key assignments like `a.b.c = 1`. - `deepRef()` (lines 247-281, the sink at line 252): the identical pattern via `pathKey(keys.slice(0, i + 1))` — reached from table headers `[a.b.c]` and array-of-tables `[[a.b.c]]` via `setPath()`/`addTableArray()`. - `setNestedKey()` (lines 184-202, the sink at line 187): the identical pattern — reached from