TOML Parser Vulnerability in toml-node for Node.js and Browser by BinaryMuse

CVE-2026-114144

What is CVE-2026-114144?

The toml-node package, a TOML parser used in Node.js and browser environments, has a vulnerability where unbounded integer sequences passed to BigInt() can lead to significant CPU resource consumption. This occurs because the range check is performed after the conversion, allowing attackers to create TOML documents that block the Node.js event loop, leading to denial of service for legitimate processes. The issue is addressed in version 5.0.1.

References