{"metadata": {"vulnerability": "CVE-2026-77465", "count": 16, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-20T20:07:49.962Z", "date_only": false, "value": "2026-08-20T20:07:49.962Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77465", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-03T20:37:22.758Z", "date_only": false, "value": "2026-09-03T20:37:22.758Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77465", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-03T20:37:22.758Z", "date_only": false, "value": "2026-09-03T20:37:22.758Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-77465", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-03T20:56:13Z", "date_only": false, "value": "2026-09-03T20:56:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-82X6-Q7MM-W9CF", "record": "GHSA-82X6-Q7MM-W9CF", "field": "published"}, {"timestamp": "2026-09-03T20:56:14Z", "date_only": false, "value": "2026-09-03T20:56:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-82X6-Q7MM-W9CF", "record": "GHSA-82X6-Q7MM-W9CF", "field": "modified"}, {"timestamp": "2026-09-03T21:05:03.446Z", "date_only": false, "value": "2026-09-03T21:05:03.446658Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc", "record": "CVE-2026-77465", "field": "creation_timestamp", "uuid": "ff639ac7-621c-40b6-91cf-b8bae87c4a65", "content": "# CVE-2026-77465: CVE-2026-77465: Uncontrolled Recursion in toml-node Deserializer Leads to Denial of Service\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77465\n\n## Summary\nAn uncontrolled recursion vulnerability (CWE-674) in the toml-node NPM package (published as toml) prior to version 4.2.0 allows unauthenticated remote attackers to trigger process-wide Denial of Service (DoS) crashes. By submitting TOML payloads with deep bracket or brace nesting, attackers exhaust the V8 runtime stack limit.\n\n## TL;DR\nA stack exhaustion vulnerability in toml-node allows remote attackers to crash Node.js application servers by submitting deeply nested arrays or inline tables, triggering a process-terminating RangeError.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: Not currently assigned\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- toml-node (NPM package 'toml')\n- **toml-node**: < 4.2.0 (Fixed in: `4.2.0`)\n\n## Mitigation\n\n- Upgrade to version 4.2.0 or higher.\n- Set 'maxDepth' in parse options if customized limits are required.\n- Implement rate limiting or payload size limits on API endpoints parsing TOML.\n\n**Remediation Steps:**\n1. Open the target repository.\n2. Execute 'npm install toml@4.2.0' to upgrade the package.\n3. Verify that package-lock.json or yarn.lock reflects the updated version.\n4. Deploy the change and monitor process logs for any RangeError instances.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-77465](https://www.cve.org/CVERecord?id=CVE-2026-77465)\n- [https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf)\n- [https://github.com/BinaryMuse/toml-node/pull/72](https://github.com/BinaryMuse/toml-node/pull/72)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77465) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc"}, {"timestamp": "2026-09-03T21:17:21.803Z", "date_only": false, "value": "2026-09-03T21:17:21.803", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77465", "record": "FKIE_CVE-2026-77465", "field": "published"}, {"timestamp": "2026-09-03T22:35:11.785Z", "date_only": false, "value": "2026-09-03T22:35:11.785311Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf", "record": "CVE-2026-77465", "field": "creation_timestamp", "uuid": "c9d70999-b264-4a62-a765-bef86e102f57", "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"}, {"timestamp": "2026-09-03T23:14:31.576Z", "date_only": false, "value": "2026-09-03T23:14:31.576214Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3munlca6fpb2m", "record": "CVE-2026-77465", "field": "creation_timestamp", "uuid": "b3f65437-afa1-4119-bfd5-8236cc0fe59e", "content": "toml-node 4.2.0\u672a\u6e80\u3067\u3001\u30cd\u30b9\u30c8\u3055\u308c\u305f\u914d\u5217\u3084\u30a4\u30f3\u30e9\u30a4\u30f3\u30c6\u30fc\u30d6\u30eb\u3092\u904e\u5270\u306b\u542b\u3080TOML\u6587\u66f8\u3092\u89e3\u6790\u3059\u308b\u3068\u3001\u30b5\u30fc\u30d3\u30b9\u505c\u6b62\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-77465 CVSS 7.5 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3munlca6fpb2m"}, {"timestamp": "2026-09-04T13:28:19.437Z", "date_only": false, "value": "2026-09-04T13:28:19.437437Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77465", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-04T13:28:19.437Z", "date_only": false, "value": "2026-09-04T13:28:19.437437Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77465", "record": "FKIE_CVE-2026-77465", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-04T13:41:25.761Z", "date_only": false, "value": "2026-09-04T13:41:25.761Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77465", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-04T13:41:25.761Z", "date_only": false, "value": "2026-09-04T13:41:25.761Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77465", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-09T21:09:13.080Z", "date_only": false, "value": "2026-09-09T21:09:13.080", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77465", "record": "FKIE_CVE-2026-77465", "field": "lastModified"}, {"timestamp": "2026-10-09T11:32:43Z", "date_only": false, "value": "2026-10-09T11:32:43Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-VM09695", "record": "CLEANSTART-2026-VM09695", "field": "modified"}, {"timestamp": "2026-10-10T00:47:57.006Z", "date_only": false, "value": "2026-10-10T00:47:57.006045Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-VM09695", "record": "CLEANSTART-2026-VM09695", "field": "published"}]}