toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

影響: npm:toml <= 5.0.0 → 5.0.1

toml.parse() converts integer literals (hex, octal, binary, and decimal) to BigInt without first bounding the length of the digit sequence. Since BigInt(string) construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or com…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:36, GitHub Advisory Database에서 "toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-114144.