Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| toml | npm | < 4.2.0 | 4.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2026-77465) in the toml-node library is an uncontrolled recursion issue, leading to a denial of service (DoS) via a stack overflow. The core problem lies in the parser's recursive-descent nature, specifically the mutual recursion between the peg$parsevalue, peg$parsearray, and peg$parseinline_table (specifically peg$parseinline_table_entry) functions within lib/parser.js. When parsing deeply nested arrays or inline tables, these functions would call each other without any depth limit, eventually exhausting the Node.js call stack and crashing the process with a RangeError: Maximum call stack size exceeded.
The provided patch (commit 967b8b06754f3ecd9863cea118dc50792a8c353f) directly addresses this by introducing a depth counter and a MAX_DEPTH limit (defaulting to 500) within the parsing logic. The peg$parsevalue function, which is the entry point for parsing values and thus the central point of recursion, was refactored to include checks that increment the depth counter before processing a value and decrement it afterwards. If the MAX_DEPTH is exceeded, a normal parse error is thrown instead of allowing a stack overflow.
Therefore, the functions identified as vulnerable are those directly involved in this recursive cycle in the unpatched version: peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry. While the patch primarily modifies peg$parsevalue to introduce the depth guard, peg$parsearray and peg$parseinline_table_entry are equally vulnerable because their calls to peg$parsevalue (which was unbounded) completed the recursive loop. An attacker exploiting this would trigger these functions in a deeply nested call sequence, leading to the crash. These function names are generated by the Peggy parser and would appear exactly as listed in a Node.js profiler stack trace.
peg$parsevaluelib/parser.js
peg$parsearraylib/parser.js
peg$parseinline_table_entrylib/parser.js