## toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-114144
- 公開日時: 2026-10-22T16:36:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-9qmh-m7c6-f92p)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-9qmh-m7c6-f92p

影響: npm:toml <= 5.0.0 → 5.0.1
toml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or com…