Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
sunnyadn js-toml — CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0041 34.3 —
AFFECTED
Product Versions Fixed
js-toml < 1.1.1 – —
TIMELINE
May 28 Reserved by GitHub_M
Jun 19 EXPLOIT PUBLISHED — CVE-2026-49293 (sunnyadn js-toml). Public exploit reference added.
Jun 19 Published (CNA: GitHub_M)
Description
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accumulator by the radix once per input digit. Each iteration performs a `BigInt * BigInt` operation on an accumulator that grows linearly with the number of digits already consumed, so the whole loop is O(n²) in the literal length. The lexer regex places no upper bound on the literal length, so a single TOML document containing one ~500 kB hex literal pins one CPU core for ~40 seconds on a modern laptop (Apple M-series, Node v22). Memory amplification is bounded but CPU amplification is severe and grows quadratically: doubling the literal length quadruples the work. A caller that invokes `load()` on attacker-controlled TOML (configuration upload endpoints, CI/CD systems ingesting third-party `*.toml`, IDE plugins, build tools) is exposed to a single-request CPU exhaustion DoS. Version 1.1.1 fixes the issue.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 28, 2026 | Reserved | Reserved by GitHub_M |
| June 19, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-49293 (sunnyadn js-toml). Public exploit reference added. |
| June 19, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| sunnyadn | js-toml | — | < 1.1.1 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49293 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.