Bound nesting depth to prevent stack-overflow DoS (GHSA-82x6-q7mm-w9cf)

CHANGELOG.md

@@ -1,7 +1,7 @@
-4.1.2 - June 30 2026
+4.2.0 - July 13 2026
 =====================
 
-* Address [security advisory `GHSA-v5mp-jgw5-2x6j`](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j) (CVE pending), in which a specially crafted TOML string could pollute `Object.prototype` process-wide..
+* Address [security advisory `GHSA-82x6-q7mm-w9cf`](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf) (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable `RangeError`. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via `toml.parse(input, { maxDepth })`.
 
 4.1.1 - March 31 2026
 =====================

README.md

@@ -60,6 +60,14 @@ try {
 }
 ```
 
+### Nesting Depth Limit
+
+To guard against stack overflow on maliciously deep input, arrays and inline tables may nest at most 500 levels deep by default; input past the limit throws a normal parse error. Adjust the limit with the `maxDepth` option:
+
+```javascript
+toml.parse(someTomlString, { maxDepth: 100 });
+```
+
 ### Date/Time Values
 
 Offset date-times are returned as JavaScript `Date` objects. Local date-times, local dates, and local times are returned as strings since they have no timezone information and can't be losslessly represented as `Date`:

index.d.ts

@@ -1,3 +1,12 @@
 declare module 'toml' {
-  export function parse(input: string): any;
+  export interface ParseOptions {
+    /**
+     * Maximum nesting depth for arrays and inline tables. Parsing input nested
+     * deeper than this throws a parse error rather than overflowing the stack.
+     * Defaults to 500.
+     */
+    maxDepth?: number;
+  }
+
+  export function parse(input: string, options?: ParseOptions): any;
 }

index.js

@@ -2,9 +2,9 @@ var parser = require('./lib/parser');
 var compiler = require('./lib/compiler');
 
 module.exports = {
-  parse: function(input) {
+  parse: function(input, options) {
     var str = input.toString();
-    var nodes = parser.parse(str);
+    var nodes = parser.parse(str, options);
     return compiler.compile(nodes, str);
   }
 };