AIKIDO-2026-114169

js-toml is vulnerable to Regular Expression Denial of Service (ReDoS)

GHSA-j4cp-cc36-jxwgPublished Aug 5, 2026

CVE Score

High

Regular Expression Denial of Service (ReDoS)

TL;DR

The multi-line basic string grammar in js-toml contains an ambiguous trailing repetition in the escaped-newline rule that overlaps with the enclosing content loop over the same whitespace and newline characters. When the lexer receives an unterminated multi-line basic string, it enumerates every composition of the trailing whitespace run, producing exponential regex backtracking. A short crafted document blocks the Node.js event loop for many seconds, and request-size limits give no protection because the cost roughly doubles every few input bytes. The fix removes the redundant trailing group so the accepted language is unchanged while the exponential blowup is eliminated.

How do I fix this?

Upgrade the js-toml library to the patch version.

Who does this affect?

You are affected if your application calls js-toml's load() on TOML that is externally influenced or otherwise not authored by you - for example services that accept TOML uploads, or build/CI systems that parse TOML from untrusted repositories. A crafted document under ~100 bytes (an unterminated multi-line basic string with a run of line-ending backslashes) can block the Node.js event loop for many seconds, and request-size limits give no protection. Applications that only parse their own trusted configuration files from disk are not exposed.