CVE-2026-77465: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-77465 is an Uncontrolled Recursion (CWE-674) vulnerability in the toml-node npm package (published as toml) that allows a remote unauthenticated attacker to crash a Node.js process by submitting a deeply nested TOML document. All versions prior to 4.2.0 are affected. The vulnerability was originally published on July 13, 2026, and added to the GitHub Advisory Database on September 3, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is unbounded mutual recursion in the Peggy 5.1.0-generated recursive-descent parser (lib/parser.js). The peg$parsevalue() function calls peg$parsearray() and peg$parseinline_table(), which in turn call back into peg$parsevalue() with no depth counter or guard, creating an unbounded recursion cycle (CWE-674). A payload of a bare array nested approximately 2,500–3,000 levels deep (~5–6 KB) reliably exhausts the Node.js call stack, raising an uncaught RangeError: Maximum call stack size exceeded rather than the expected SyntaxError. Because the parser is machine-generated from src/toml.pegjs, the fix must be applied at the grammar level or via an entry-point guard — not by editing the generated parser directly. A confirmed public PoC is included in the security advisory (Github Advisory, Security Advisory).

Successful exploitation results in a denial of service: the Node.js call stack is exhausted, the process throws an uncaught RangeError, and the affected request worker or process terminates. There is no confidentiality or integrity impact. Because toml.parse() is the package's only public API and the RangeError is not a subclass of the parser's SyntaxError, standard error-handling patterns that filter for parse errors will rethrow the exception, amplifying the crash impact. With approximately 47 million monthly downloads, the exposure surface is broad across any Node.js application that parses untrusted TOML input (Github Advisory).

A confirmed proof-of-concept is publicly documented in the GitHub Security Advisory, requiring only a ~6 KB crafted TOML payload and no authentication or special privileges. No exploit kits or in-the-wild exploitation have been reported as of the advisory date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target: Locate a Node.js application that accepts user-supplied TOML input and passes it to toml.parse() (e.g., a /config endpoint accepting application/toml content type).
2. Craft payload: Generate a deeply nested TOML array payload. A reliable payload nests an array ~3,000 levels deep (~6 KB):

let x = '1';
for (let i = 0; i < 3000; i++) x = '[' + x + ']';
const payload = 'a=' + x; // ~6003 bytes

3. Send HTTP request: POST the crafted payload to the target endpoint with the appropriate content type:

POST /config HTTP/1.1
Content-Type: application/toml
Content-Length: 6003

a=[[[...3000 levels...]]]

4. Trigger stack overflow: toml.parse() recurses through peg$parsevalue → peg$parsearray → peg$parsevalue until the Node.js call stack is exhausted, raising RangeError: Maximum call stack size exceeded.
5. Crash worker/process: If the application's error handler only catches SyntaxError (or checks e.line != null), the RangeError propagates as an unhandled exception, terminating the request worker or the entire Node.js process, causing denial of service (Github Advisory, Security Advisory).

• Network: Repeated HTTP POST requests to TOML-parsing endpoints (e.g., /config) with small payloads (~5–12 KB) containing high densities of [ and { characters; requests that do not receive a normal application response.
• Logs: Node.js process crash logs or unhandled exception logs containing RangeError: Maximum call stack size exceeded originating from lib/parser.js (toml-node); sudden worker restarts in process managers (e.g., PM2, cluster) correlated with specific request timestamps.
• Process: Unexpected termination of Node.js worker processes; process manager logs showing repeated worker respawns triggered by uncaught exceptions from the TOML parsing code path (Github Advisory).

Upgrade toml (npm) to version 4.2.0 or later, which introduces a depth guard on the value grammar rule capping nesting at 500 levels by default and raising a normal parse error instead of overflowing the stack. The limit is configurable via toml.parse(input, { maxDepth: N }). As an immediate workaround for users unable to upgrade, pre-validate untrusted input by counting bracket nesting depth and rejecting payloads where [ or { nesting exceeds a few hundred levels — note that a byte-length limit alone is insufficient since a ~5 KB payload already triggers the crash. Additionally, wrap toml.parse() calls in a try/catch that handles both SyntaxError and RangeError to prevent uncaught exceptions from terminating the process (Github Advisory, Fix PR).