AIKIDO-2026-114169

js-toml is vulnerable to Regular Expression Denial of Service (ReDoS)

Regular Expression Denial of Service (ReDoS)GHSA-j4cp-cc36-jxwg Published 2 days ago

High Risk

This Affects:

js-toml

0.0.1 - 1.2.1

Fixed in 1.2.2

Are you affected? Scan for Free

TL;DR

The multi-line basic string grammar in js-toml contains an ambiguous trailing repetition in the escaped-newline rule that overlaps with the enclosing content loop over the same whitespace and newline characters. When the lexer receives an unterminated multi-line basic string, it enumerates every composition of the trailing whitespace run, producing exponential regex backtracking. A short crafted document blocks the Node.js event loop for many seconds, and request-size limits give no protection because the cost roughly doubles every few input bytes. The fix removes the redundant trailing group so the accepted language is unchanged while the exponential blowup is eliminated.

Who does this affect?

You are affected if your application calls js-toml's load() on TOML that is externally influenced or otherwise not authored by you - for example services that accept TOML uploads, or build/CI systems that parse TOML from untrusted repositories. A crafted document under ~100 bytes (an unterminated multi-line basic string with a run of line-ending backslashes) can block the Node.js event loop for many seconds, and request-size limits give no protection. Applications that only parse their own trusted configuration files from disk are not exposed.