toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.

CVE-2026-77465 affects toml-node, a TOML parser for Node.js and browsers, in versions prior to 4.2.0. The vulnerability exists in the Peggy 5.1.0 generated recursive-descent parser within lib/parser.js, where functions peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry recurse through nested arrays and inline tables without any depth limit. A remote unauthenticated attacker can craft a malicious TOML document with thousands of nested arrays or inline tables to exhaust the Node.js call stack. This causes an unexpected RangeError instead of the expected SyntaxError, which can terminate unprotected request workers or processes, resulting in a denial of service. The root cause is in the grammar source file src/toml.pegjs where no recursion bounding is enforced. The vulnerability has been patched in version 4.2.0 of toml-node.