CVE-2026-114144

What it actually does

Unbounded hexadecimal, octal, binary, and decimal digit sequences supplied to toml.parse() are passed directly to BigInt() in lib/parser.js before reduceInteger() in lib/compiler.js performs the TOML 64-bit range check, causing super-linear CPU consumption that synchronously blocks the Node.js event loop.

Why it matters to the business

Applications using the parser become unavailable to legitimate users when a single malicious TOML document is processed, leading to service disruption and potential loss of concurrent operations until the process recovers or is restarted.

How an attack unfolds

An attacker crafts a TOML document containing an excessively long integer literal and submits it to any endpoint that invokes toml.parse() on untrusted input; the library performs the costly BigInt conversion before the range validation, exhausting CPU and blocking the event loop for the duration of the conversion.

How to fix it

Upgrade toml-node to version 5.0.1 or later, which moves the integer range validation before the BigInt conversion; where immediate upgrade is not possible, enforce strict input size limits or schema validation on TOML documents prior to parsing.

How to confirm the fix worked

Confirm the installed package version is at least 5.0.1 via package.json or npm list; test by submitting a TOML document with an integer exceeding 64 bits and verifying that parsing fails quickly with a range error instead of consuming excessive CPU time.

Typical attack path

1. Identify an application endpoint or API that accepts TOML input via toml-node
2. Generate a TOML payload containing an integer literal thousands of digits long
3. Transmit the payload in a single request to trigger synchronous BigInt() evaluation
4. Observe sustained high CPU usage and blocked request handling in the target process

How to detect it

Review application and system logs for sudden sustained high CPU on threads handling TOML parsing, unusually long request processing times for TOML endpoints, and any error logs indicating BigInt conversion of oversized integers; correlate with inbound requests containing large numeric strings.

What your security team should do

• Immediately upgrade all instances of toml-node to 5.0.1 or newer
• Add input-length and schema validation around all TOML parsing entry points
• Monitor CPU utilization and request latency for spikes correlated with TOML ingestion
• Review dependency graphs to identify any transitive usage of the vulnerable parser