CVE-2026-114144 Details
Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
A denial-of-service vulnerability has been identified in toml-node, a TOML parser for Node.js and the browser. This issue affects versions through 5.0.0. The vulnerability arises because toml.parse() converts integer literals (hexadecimal, octal, binary, and decimal) to BigInt without first limiting the length of the digit sequences. As a result, a sufficiently long integer string can cause excessive CPU consumption, blocking the Node.js event loop and disrupting concurrent processes. The problem is exacerbated by the fact that the length check is performed after the costly BigInt conversion, allowing a single malicious TOML document to cause significant disruption.
Users are advised to update to toml-node version 5.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead | [email protected] | Source CodeVendor |
| https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1 | [email protected] | Release NotesVendor |
| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BinaryMuse toml-node | <= 5.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |