TOML Parser Vulnerability in js-toml by Sunnyadn

CVE-2026-49293

What is CVE-2026-49293?

The js-toml package, a TOML parser for JavaScript, has a vulnerability that can lead to CPU exhaustion when parsing long integer literals. Due to the inefficiency of the parseBigInt function, which performs operations on a BigInt accumulator in a manner that grows quadratically with the input size, a single parsed document containing a large hex literal can monopolize CPU resources. This significantly affects systems that rely on this parser for configuration files in environments like CI/CD processes or development tools. Users are encouraged to upgrade to version 1.1.1 to mitigate this issue.

References