Resource exhaustion in Binarymuse Toml-Node
CVE-2026-114144
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Binarymuse Toml-Node — versions < 5.0.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-114144?
- CVE-2026-114144 is a high-severity vulnerability in Binarymuse Toml-Node, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-10-21.
- How severe is CVE-2026-114144?
- High severity. CVSS v3 base score is 7.5 out of 10.