Executive brief
The js-toml library, used for parsing TOML configuration files in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted TOML file containing a very long number (such as a large hexadecimal value) that causes the application's processor to become overwhelmed. This can lead to the application becoming unresponsive, potentially disrupting services for all users.
Technical details
The vulnerability exists in the `parseBigInt` function within `src/load/tokens/NonDecimalInteger.ts`. The parser uses a hand-written loop that performs a BigInt multiplication and addition for every digit in a radix-prefixed literal. Because the accumulator grows linearly, the overall complexity is quadratic O(n²). Since the lexer does not impose a length limit on these literals, an attacker can provide a large literal (e.g., 500KB) that blocks the Node.js event loop for significant periods (40+ seconds). The issue is resolved in version 1.1.1 by switching to the native V8 BigInt constructor and implementing a length guard.
Affected products
- sunnyadn js-toml <= 1.1.0
Timeline
- 2026-05-25: advisory: Initial GitHub Advisory published
- 2026-06-26: patched: Fix committed and advisory updated