The js-toml JavaScript TOML parser (versions <=1.1.0) has an uncontrolled resource consumption vulnerability (CWE-400) due to its `parseBigInt` function. This function parses integer literals by repeatedly multiplying a BigInt accumulator by the radix for each digit, resulting in O(n²) CPU complexity relative to the literal length. The lexer does not limit the length of these literals, enabling an attacker to craft a single large hexadecimal (or octal/binary) literal (~500 kB) that can exhaust CPU resources for approximately 40 seconds on modern hardware. This vulnerability can be exploited via attacker-controlled TOML inputs in contexts such as configuration uploads or CI/CD pipelines. The vulnerability is tracked as CVE-2026-49293 with a CVSS 3.1 base score of 7.5 (high severity). The issue is resolved in js-toml version 1.1.1.

An attacker can cause a denial of service by submitting a specially crafted TOML document containing a very large hexadecimal, octal, or binary integer literal. This triggers a CPU exhaustion condition due to the quadratic time complexity of the parsing loop, effectively pinning a CPU core for tens of seconds. There is no impact on confidentiality or integrity, but availability is severely affected during exploitation.

Upgrade js-toml to version 1.1.1 or later, where this vulnerability is fixed. Until then, avoid processing untrusted TOML inputs or implement input size restrictions on integer literals to mitigate CPU exhaustion. Patch status is not explicitly stated in the vendor advisory, but version 1.1.1 is confirmed to fix the issue.