CVE-2026-49293: js-toml CPU exhaustion via O(n²) BigInt construction

CVE-2026-49293 · Severity: high · CVSS 7.5 · Published 2026-06-19

The js-toml library, used for parsing TOML configuration files in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted TOML file containing a very long number (such as a large hexadecimal value) that causes the application's processor to become overwhelmed. This can lead to the application becoming unresponsive, potentially disrupting services for all users.

Technologies: js-toml (npm), Sunnyadn Js-Toml. Vendors: npm, Sunnyadn.

Quick answers

Is CVE-2026-49293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49293 being exploited in the wild.
How severe is CVE-2026-49293?
High severity, with a CVSS score of 7.5, published 19 June 2026.
Which products and versions are affected?
js-toml (npm) SEMVER:introduced=0,fixed=1.1.1; Sunnyadn Js-Toml <= 1.1.0.
Is there a fix for CVE-2026-49293?
Yes. js-toml (npm): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49293 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49293?
Check whether you run js-toml (npm) or Sunnyadn Js-Toml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • js-toml (npm): upgrade to 1.1.1 or later
    npm install js-toml@1.1.1

Technical details

The vulnerability exists in the `parseBigInt` function within `src/load/tokens/NonDecimalInteger.ts`. The parser uses a hand-written loop that performs a BigInt multiplication and addition for every digit in a radix-prefixed literal. Because the accumulator grows linearly, the overall complexity is quadratic O(n²). Since the lexer does not impose a length limit on these literals, an attacker can provide a large literal (e.g., 500KB) that blocks the Node.js event loop for significant periods (40+ seconds). The issue is resolved in version 1.1.1 by switching to the native V8 BigInt constructor and implementing a length guard.

Affected products

  • sunnyadn js-toml <= 1.1.0

Identifiers

  • CVE-2026-49293
  • GHSA-wp3c-266w-4qfq

Timeline

  • 2026-05-25: advisory: Initial GitHub Advisory published
  • 2026-06-26: patched: Fix committed and advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.