{"id":"ghsa-ghsa-9qmh-m7c6-f92p","seq":309568,"kind":"advisory","title":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()","url":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9qmh-m7c6-f92p","summary":"影響: npm:toml <= 5.0.0 → 5.0.1\ntoml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or com…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-114144"],"tags":["GHSA-9qmh-m7c6-f92p","toml"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:36:50.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}