{"uuid": "ff639ac7-621c-40b6-91cf-b8bae87c4a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77465", "type": "seen", "source": "https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc", "content": "# CVE-2026-77465: CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77465\n\n## Summary\nAn uncontrolled recursion vulnerability (CWE-674) in the toml-node NPM package (published as toml) prior to version 4.2.0 allows unauthenticated remote attackers to trigger process-wide Denial of Service (DoS) crashes. By submitting TOML payloads with deep bracket or brace nesting, attackers exhaust the V8 runtime stack limit.\n\n## TL;DR\nA stack exhaustion vulnerability in toml-node allows remote attackers to crash Node.js application servers by submitting deeply nested arrays or inline tables, triggering a process-terminating RangeError.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: Not currently assigned\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- toml-node (NPM package 'toml')\n- **toml-node**: < 4.2.0 (Fixed in: `4.2.0`)\n\n## Mitigation\n\n- Upgrade to version 4.2.0 or higher.\n- Set 'maxDepth' in parse options if customized limits are required.\n- Implement rate limiting or payload size limits on API endpoints parsing TOML.\n\n**Remediation Steps:**\n1. Open the target repository.\n2. Execute 'npm install toml@4.2.0' to upgrade the package.\n3. Verify that package-lock.json or yarn.lock reflects the updated version.\n4. Deploy the change and monitor process logs for any RangeError instances.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-77465](https://www.cve.org/CVERecord?id=CVE-2026-77465)\n- [https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf)\n- [https://github.com/BinaryMuse/toml-node/pull/72](https://github.com/BinaryMuse/toml-node/pull/72)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77465) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T21:05:03.446658Z"}