# CVE-2026-49293: js-toml CPU exhaustion via O(n²) BigInt construction

Source: https://junglewise.ai/threats/cve-2026-49293-js-toml-cpu-exhaustion-via-o-n-bigint-construction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-49293 · Severity: high · CVSS 7.5 · Published 2026-06-19

The js-toml library, used for parsing TOML configuration files in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted TOML file containing a very long number (such as a large hexadecimal value) that causes the application's processor to become overwhelmed. This can lead to the application becoming unresponsive, potentially disrupting services for all users.

Technologies: [js-toml (npm)](https://junglewise.ai/threats/technologies/npm-js-toml), [Sunnyadn Js-Toml](https://junglewise.ai/threats/technologies/js-toml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Sunnyadn](https://junglewise.ai/threats/vendors/sunnyadn).

## Quick answers

**Is CVE-2026-49293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49293 being exploited in the wild.

**How severe is CVE-2026-49293?** High severity, with a CVSS score of 7.5, published 19 June 2026.

**Which products and versions are affected?** js-toml (npm) SEMVER:introduced=0,fixed=1.1.1; Sunnyadn Js-Toml <= 1.1.0.

**Is there a fix for CVE-2026-49293?** Yes. js-toml (npm): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49293 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49293?** Check whether you run js-toml (npm) or Sunnyadn Js-Toml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- js-toml (npm): upgrade to 1.1.1 or later

  ```sh
  npm install js-toml@1.1.1
  ```


## Technical details

The vulnerability exists in the `parseBigInt` function within `src/load/tokens/NonDecimalInteger.ts`. The parser uses a hand-written loop that performs a BigInt multiplication and addition for every digit in a radix-prefixed literal. Because the accumulator grows linearly, the overall complexity is quadratic O(n²). Since the lexer does not impose a length limit on these literals, an attacker can provide a large literal (e.g., 500KB) that blocks the Node.js event loop for significant periods (40+ seconds). The issue is resolved in version 1.1.1 by switching to the native V8 BigInt constructor and implementing a length guard.

## Affected products

- sunnyadn js-toml <= 1.1.0

## Identifiers

- CVE-2026-49293
- GHSA-wp3c-266w-4qfq

## Timeline

- 2026-05-25: advisory: Initial GitHub Advisory published
- 2026-06-26: patched: Fix committed and advisory updated

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [js-toml stack exhaustion in recursive parser](https://junglewise.ai/threats/cve-2026-63386-js-toml-is-a-toml-parser-for-javascript-prior-to-1-1-3-load-does)
- [sunnyadn js-toml type confusion via duplicate-key bypass](https://junglewise.ai/threats/cve-2026-50029-sunnyadn-js-toml-type-confusion-via-duplicate-key-bypass)
- [js-toml prototype pollution via malicious TOML](https://junglewise.ai/threats/cve-2025-54803-js-toml-prototype-pollution-via-malicious-toml)