https://vulnerability.circl.lu/sightings/feed 2026-09-12T14:10:02.835072+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b3f65437-afa1-4119-bfd5-8236cc0fe59e/export 2026-09-12T14:10:02.871368+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b3f65437-afa1-4119-bfd5-8236cc0fe59e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77465", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3munlca6fpb2m", "content": "toml-node 4.2.0\u672a\u6e80\u3067\u3001\u30cd\u30b9\u30c8\u3055\u308c\u305f\u914d\u5217\u3084\u30a4\u30f3\u30e9\u30a4\u30f3\u30c6\u30fc\u30d6\u30eb\u3092\u904e\u5270\u306b\u542b\u3080TOML\u6587\u66f8\u3092\u89e3\u6790\u3059\u308b\u3068\u3001\u30b5\u30fc\u30d3\u30b9\u505c\u6b62\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-77465 CVSS 7.5 | HIGH", "creation_timestamp": "2026-09-03T23:14:31.576214Z"} 2026-09-03T23:14:31.576214+00:00 https://vulnerability.circl.lu/sighting/c9d70999-b264-4a62-a765-bef86e102f57/export 2026-09-12T14:10:02.873074+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "c9d70999-b264-4a62-a765-bef86e102f57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77465", "type": "published-proof-of-concept", "source": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf", "content": "", "creation_timestamp": "2026-09-03T22:35:11.785311Z"} 2026-09-03T22:35:11.785311+00:00 https://vulnerability.circl.lu/sighting/ff639ac7-621c-40b6-91cf-b8bae87c4a65/export 2026-09-12T14:10:02.874826+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ff639ac7-621c-40b6-91cf-b8bae87c4a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77465", "type": "seen", "source": "https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc", "content": "# CVE-2026-77465: CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77465\n\n## Summary\nAn uncontrolled recursion vulnerability (CWE-674) in the toml-node NPM package (published as toml) prior to version 4.2.0 allows unauthenticated remote attackers to trigger process-wide Denial of Service (DoS) crashes. By submitting TOML payloads with deep bracket or brace nesting, attackers exhaust the V8 runtime stack limit.\n\n## TL;DR\nA stack exhaustion vulnerability in toml-node allows remote attackers to crash Node.js application servers by submitting deeply nested arrays or inline tables, triggering a process-terminating RangeError.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: Not currently assigned\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- toml-node (NPM package 'toml')\n- **toml-node**: < 4.2.0 (Fixed in: `4.2.0`)\n\n## Mitigation\n\n- Upgrade to version 4.2.0 or higher.\n- Set 'maxDepth' in parse options if customized limits are required.\n- Implement rate limiting or payload size limits on API endpoints parsing TOML.\n\n**Remediation Steps:**\n1. Open the target repository.\n2. Execute 'npm install toml@4.2.0' to upgrade the package.\n3. Verify that package-lock.json or yarn.lock reflects the updated version.\n4. Deploy the change and monitor process logs for any RangeError instances.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-77465](https://www.cve.org/CVERecord?id=CVE-2026-77465)\n- [https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf)\n- [https://github.com/BinaryMuse/toml-node/pull/72](https://github.com/BinaryMuse/toml-node/pull/72)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77465) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T21:05:03.446658Z"} 2026-09-03T21:05:03.446658+00:00