CVE-2026-114143
Description
A flaw was found in toml-node. A remote attacker could cause a Denial of Service (DoS) by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory resources to the point of freezing or terminating the application.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote user can trigger complete application downtime or crash the Node.js runtime environment without requiring elevated privileges. Red Hat products utilizing this parser in services or management interfaces that accept untrusted configuration files can face denial of service when processing inputs with extended key hierarchies. Because the parser runs synchronously within the main execution loop, small payloads can exhaust system memory or starve concurrent operations across the host application.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
