CVE-2026-49293: js-toml CPU Exhaustion Vulnerability via Inefficient BigInt Parsing
Summary
CVE-2026-49293: js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals. Affects js-toml versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
js-toml is a JavaScript library used for parsing TOML (Tom's Obvious, Minimal Language) configuration files. It allows developers to easily read and manipulate TOML data structures in their applications. The library is widely utilized in various Node.js applications for configuration management. However, versions up to and including 1.1.0 are vulnerable to a CPU exhaustion attack due to inefficient parsing of large radix-prefixed integer literals, which can lead to significant performance degradation.
Vulnerability Detail
The vulnerability arises from the way js-toml handles hexadecimal, octal, and binary integer literals. The parsing function, parseBigInt, uses a loop that multiplies a BigInt accumulator by the radix for each digit in the input string. This results in a time complexity of O(n^2), where n is the length of the literal. As a consequence, a single TOML document with a large radix-prefixed integer can cause a CPU core to be pinned for an extended period, leading to denial of service (DoS) conditions. Attackers can exploit this vulnerability by supplying a specially crafted TOML document, causing the application to become unresponsive.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
npm install js-toml@2.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.1
This is the first release that contains the fix.
npm install js-toml@1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing input validation to restrict the size of TOML documents processed by your application. This can help mitigate the risk of CPU exhaustion by ensuring that only small, manageable TOML files are accepted.
Conclusion
The js-toml library has a critical vulnerability that can lead to CPU exhaustion through inefficient parsing of large integer literals. It is essential to update to version 1.1.1 or later to mitigate this risk. Implementing input validation can also help reduce exposure to this vulnerability.
See every vulnerability recorded for js-toml →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check your application by uploading your package-lock.json file or using the Vulert playground without any signup.
The potential impacts include CPU exhaustion, leading to denial of service (DoS) conditions, where the application becomes unresponsive due to excessive CPU usage.
Yes, you can implement input validation to restrict the size of TOML documents processed by your application, thus reducing the risk of CPU exhaustion.
The patched version replaces the inefficient parseBigInt function with the native BigInt constructor, which processes radix-prefixed integers in linear time, improving performance significantly.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-toml.
