CVE-2026-77465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77465", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T20:07:49.962Z", "datePublished": "2026-09-03T20:37:22.758Z", "dateUpdated": "2026-09-04T13:41:25.761Z"}, "containers": {"cna": {"title": "toml-node: Uncontrolled Recursion", "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "lang": "en", "description": "CWE-674: Uncontrolled Recursion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"}, {"name": "https://github.com/BinaryMuse/toml-node/pull/72", "tags": ["x_refsource_MISC"], "url": "https://github.com/BinaryMuse/toml-node/pull/72"}, {"name": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f", "tags": ["x_refsource_MISC"], "url": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"}], "affected": [{"vendor": "BinaryMuse", "product": "toml-node", "versions": [{"version": "< 4.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-03T20:37:22.758Z"}, "descriptions": [{"lang": "en", "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."}], "source": {"advisory": "GHSA-82x6-q7mm-w9cf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-04T13:28:19.437437Z", "id": "CVE-2026-77465", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T13:41:25.761Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-04T13:28:19.437437Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T13:28:20.381Z"}}], "cna": {"title": "toml-node: Uncontrolled Recursion", "source": {"advisory": "GHSA-82x6-q7mm-w9cf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "BinaryMuse", "product": "toml-node", "versions": [{"status": "affected", "version": "< 4.2.0"}]}], "references": [{"url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf", "name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/BinaryMuse/toml-node/pull/72", "name": "https://github.com/BinaryMuse/toml-node/pull/72", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f", "name": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674: Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-03T20:37:22.758Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77465", "state": "PUBLISHED", "dateUpdated": "2026-09-04T13:41:25.761Z", "dateReserved": "2026-08-20T20:07:49.962Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-03T20:37:22.758Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "toml-node", "vendor": "BinaryMuse", "versions": [{"status": "affected", "version": "< 4.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."}], "id": "CVE-2026-77465", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77465", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-04T13:28:19.437437Z", "version": "2.0.3"}}]}, "published": "2026-09-03T21:17:21.803", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"}, {"source": "security-advisories@github.com", "url": "https://github.com/BinaryMuse/toml-node/pull/72"}, {"source": "security-advisories@github.com", "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "toml-node: toml-node: Denial of Service via uncontrolled recursion in TOML parsing", "id": "2528258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528258"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-606", "details": ["A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeError and terminating the application process, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "No mitigation is required. The vulnerable parser runs only in the user's browser when they actively upload a TOML blueprint file, and the application's error handling catches the resulting exception."}, "name": "CVE-2026-77465", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cockpit-image-builder", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-09-03T20:37:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77465\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77465\nhttps://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f\nhttps://github.com/BinaryMuse/toml-node/pull/72\nhttps://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"], "statement": "The toml npm package is bundled in cockpit-image-builder, but the vulnerable TOML parser is only invoked client-side when an authenticated user manually uploads a blueprint file. The parsing error is caught, limiting impact to a browser-side error notification. Red Hat rates this as Low impact.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "toml-node", "source": "cna", "vendor": "BinaryMuse"}, "product": "toml-node", "vendor": "binarymuse"}], "created": "2026-09-03T21:45:09.660186+00:00", "updated": "2026-09-04T15:22:09.148984+00:00", "vendors": ["binarymuse", "binarymuse$PRODUCT$toml-node"]}