{"items":[{"id":"NVI-00014079","kind":"vulnerability","title":"toml-node: Uncontrolled Recursion","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-82x6-q7mm-w9cf","CVE-2026-77465"],"plain_summary":"GitHub lists this reviewed advisory for toml. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3fa9a7e6d4abaa0d07ec12f8e49472b8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-03T20:56:14.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3fa9a7e6d4abaa0d07ec12f8e49472b8"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3fa9a7e6d4abaa0d07ec12f8e49472b8","url":"https://github.com/advisories/GHSA-82x6-q7mm-w9cf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-82x6-q7mm-w9cf","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:29.477Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3fa9a7e6d4abaa0d07ec12f8e49472b8"],"technology":"toml","known_exclusions":[],"conditions_summary":"### Summary\n\n\n`toml.parse()` crashes with an uncaught `RangeError: Maximum call stack size exceeded` when parsing deeply nested arrays or inline tables. The parser is generated by **Peggy 5.1.0** (a PEG parser generator) as a recursive-descent parser; the value rule mutually recurses with the array and inline-table rules with **no depth limit**, so nesting depth equal to the input depth exhausts Node's call stack.\n\nA small payload — a bare array nested a few thousand levels deep (**~5–6 KB**) — reliably crashes the process on a default Node.js configuration. `toml` has **~47 million monthly downloads**.\n\n---\n\n## Vulnerable Code\n\nThe parser is a **generated** recursive-descent parser (`lib/parser.js`, header: `// @generated by Peggy 5.1.0.`). The recursion sink is the mutual recursion between the `value`, `array`, and `inline_table` rule functions — none carry a depth counter:\n\n```javascript\n// lib/parser.js — peg$parsevalue() @ line 1008\nfunction peg$parsevalue() {\n  ...\n  s0 = peg$parsearray();          // line 1017  ← value → array\n  if (s0 === peg$FAILED) {\n    s0 = peg$parseinline_table(); // line 1019  ← value → inline_table\n  }\n  ...\n}\n\n// peg$parsearray() @ line 2879\nfunctio","public_affected_ranges":["< 4.2.0"]}],"null_published_at":"2026-11-02T10:00:37.204Z","source_updated_at":"2026-09-03T20:56:14.000Z","source_disclosed_at":"2026-09-03T20:56:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:29.477Z"}],"next_cursor":null,"snapshot_revision":"42594"}