CVE-2026-114144: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
toml-nodeto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using toml-node before 5.0.1 are exposed if they call toml.parse() on TOML documents influenced by an attacker. A single supplied document containing a sufficiently long integer literal can synchronously block the Node.js event loop and disrupt concurrent work in that process.
What input is needed to trigger the problem?
An attacker needs to provide TOML containing an unbounded-length integer literal in decimal, hexadecimal, octal, or binary form. No authentication, user interaction, or special parser configuration is indicated in the available data.
Does TOML's 64-bit integer range validation prevent the CPU exhaustion?
No. The parser converts the digit sequence with BigInt() before checking in reduceInteger() whether the value fits the TOML 64-bit integer range, so the expensive conversion has already occurred.
What version resolves the issue?
Upgrade toml-node to version 5.0.1, which fixes the unbounded integer conversion behavior.