Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114144— toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Quick assessment

Affected
BinaryMuse toml-node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

toml-node 是一个用于 Node.js 和浏览器的 TOML 解析器。在 5.0.1 版本之前， 函数会将来自 的无界十六进制、八进制、二进制和十进制数字序列传递给 函数，而 中的 函数仅在此之后才检查所得数值是否符合 TOML 64 位整数范围。将足够长的整数字符串转换为 BigInt 会消耗超线性的 CPU 时间，并同步阻塞 Node.js 事件循环，使得攻击者提供的单个 TOML 文档即可导致该进程中并发的其他工作无法正常运行（即拒绝服务）。由于范围检查在 转换之后才执行，因此无法避免此次转换带来的性

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114144

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
Source: CVE Program / CVE List V5
Vulnerability Description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BinaryMuse toml-node < 5.0.1 -

II. Public POCs for CVE-2026-114144

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114144

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114144 (1)

Vendor Advisories for CVE-2026-114144 (1)

Vendor Pages for CVE-2026-114144 (1)

Same Patch Batch · BinaryMuse · 2026-10-21 · 4 CVEs total

CVE-2026-114142 8.8 HIGH toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114143 8.7 HIGH toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114141 8.7 HIGH toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

IV. Related Vulnerabilities

Same product: toml-node
Same vendor: BinaryMuse
Same weakness: CWE-400

V. Comments for CVE-2026-114144

No comments yet

Leave a comment