CVE-2026-114144

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1

Description The toml.parse() function passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before the reduceInteger() function in lib/compiler.js verifies if the value fits the TOML 64-bit integer range. Because the range check occurs after the conversion, processing a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, enabling a denial of service for concurrent work in the process.

Recommendations Update to version 5.0.1.