CVE-2026-49293

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.1

Description The software contains a quadratic time complexity issue during the parsing of hexadecimal, octal, and binary integer literals. This occurs because the parseBigInt() function uses a loop that performs a BigInt * BigInt operation for each input digit, resulting in O(n²) CPU consumption relative to the literal length. Since the lexer regex does not limit the length of these literals, an attacker can provide a specially crafted TOML document to cause CPU exhaustion, leading to a Denial of Service (DoS). This affects callers using the load() function on untrusted input, such as configuration upload endpoints or CI/CD systems.

Recommendations Update to version 1.1.1.