CVE-2026-63386: js-toml Parser DOS Vulnerability

CVE-2026-63386 Overview

CVE-2026-63386 is a denial-of-service vulnerability in js-toml, a TOML parser for JavaScript, affecting all versions prior to 1.1.3. The load() function does not bound nesting depth or dotted-key depth in its recursive parser and interpreter. Attackers can submit crafted TOML input with deeply nested arrays, deeply nested inline tables, or long dotted keys to exhaust the V8 call stack. The parser throws a raw RangeError instead of the documented SyntaxParseError, causing consuming applications to rethrow the unexpected exception and terminate a worker or process. The issue is fixed in version 1.1.3 and is categorized under [CWE-674] Uncontrolled Recursion.

Critical Impact
Applications parsing attacker-controlled TOML with js-toml can be crashed via crafted input that triggers stack exhaustion in the recursive parser.

Affected Products

js-toml versions prior to 1.1.3
Node.js applications consuming attacker-controlled TOML through js-toml
Workers or processes that only catch SyntaxParseError from js-toml

Discovery Timeline

2026-09-22 - CVE-2026-63386 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63386

Vulnerability Analysis

The vulnerability resides in the recursive descent parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts. Neither component enforces a maximum recursion depth when descending into nested arrays, inline tables, or dotted-key chains. Each additional nesting level adds a JavaScript stack frame in the V8 engine. Sufficient nesting exhausts the stack and the runtime throws a synchronous RangeError: Maximum call stack size exceeded.

The documented API contract states that malformed TOML surfaces as SyntaxParseError. Consumers that follow this contract wrap load() in try/catch blocks that only handle SyntaxParseError. A raw RangeError bypasses this handler and propagates to the host, terminating the Node.js worker or process. The vulnerability affects availability only. Confidentiality and integrity remain intact.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the parsing and interpretation logic. The parser lacks a depth counter, and the interpreter walks the resulting abstract syntax tree without an upper bound. Any TOML construct that maps to recursive descent, including array-of-arrays, nested inline tables, and long dotted keys, translates directly into JavaScript call-stack growth.

Attack Vector

An unauthenticated attacker supplies TOML content over the network to any endpoint that invokes load() on user input. Common exposure points include configuration upload features, package metadata parsers, and API services accepting TOML payloads. Payload construction requires only repeated opening tokens such as [[[[... or chained dotted keys like a.a.a.a... to trigger the crash.

typescript

// Patch: src/load/exception.ts — introduces bounded-depth error type
     super(message);
   }
 }
+
+export class DepthLimitError extends SyntaxParseError {
+  constructor(maxDepth: number) {
+    super(`Maximum nesting depth of ${maxDepth} exceeded`);
+  }
+}

Source: GitHub Commit 4e10acf

The fix introduces DepthLimitError, which extends SyntaxParseError. The patched parser tracks recursion depth and throws DepthLimitError when the configured DEFAULT_MAX_DEPTH is exceeded, preserving the documented exception contract.

Detection Methods for CVE-2026-63386

Indicators of Compromise

Unhandled RangeError: Maximum call stack size exceeded exceptions in Node.js logs originating from js-toml stack frames
Sudden worker or process restarts correlated with TOML parsing requests
Inbound TOML payloads containing long runs of [ or { characters or unusually long dotted-key sequences

Detection Strategies

Inspect application logs for RangeError stack traces referencing src/load/parser.ts or src/load/interpreter.ts
Deploy input-size and structural limits at ingress to flag TOML documents with excessive bracket nesting or dotted-key length
Use dependency scanners to identify js-toml versions below 1.1.3 in package-lock.json and yarn.lock files

Monitoring Recommendations

Track process crash and restart rates for services that accept TOML input
Alert on repeated 5xx responses from endpoints that parse user-supplied configuration files
Enable structured exception logging that captures exception class names to distinguish RangeError from SyntaxParseError

How to Mitigate CVE-2026-63386

Immediate Actions Required

Upgrade js-toml to version 1.1.3 or later across all Node.js services
Audit exception handlers around load() calls to catch both SyntaxParseError and generic exceptions
Restrict TOML payload size at API gateways and reverse proxies to reduce attack surface

Patch Information

The fix is available in js-toml 1.1.3. The patch bounds recursion depth in both the parser and interpreter and exposes DEFAULT_MAX_DEPTH and a LoadOptions type for consumers who need to tune the limit. See the GitHub Release v1.1.3 and the GitHub Security Advisory GHSA-3g82-77xr-68x5 for full details.

Workarounds

Wrap load() calls in a broad try/catch block that handles any exception type, not only SyntaxParseError
Reject TOML input above a fixed byte-size threshold before invoking the parser
Pre-validate incoming TOML with a lightweight structural check that rejects nesting beyond a chosen depth

bash

# Upgrade js-toml to the patched release
npm install js-toml@^1.1.3

# Verify the installed version
npm ls js-toml