js-toml versions up to and including 1.1.0 contain a vulnerability in the parsing of radix-prefixed integer literals (hexadecimal, octal, binary) where a quadratic time complexity in BigInt construction can cause CPU exhaustion. The parser's loop multiplies a BigInt accumulator by the radix for each digit, resulting in O(n²) complexity with respect to the literal length. There is no upper bound on the length of these literals, allowing an attacker to craft a single large literal (~500 kB) that can pin a CPU core for about 40 seconds, causing a denial of service. This affects any use of the load() function on attacker-controlled TOML input. The issue is fixed in version 1.1.2.