Description
js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit.
Recommendation
Update the js-toml package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.1.0
- Patched version(s): 1.1.1
References
Could your website be exposed too?
SmartScanner can check your website for js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
- js-toml has silent type confusion via falsy-primitive duplicate-key bypass - CVE-2026-50029
- @conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields - CVE-2026-49250
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
You might also like:
See something that needs correcting? Let us knowUpdated June 26, 2026