CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-49293 · CVE overview and exploitation status

EUVD-2026-38060

GHSA-wp3c-266w-4qfq

cve-program · CVE-2026-49293

• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq
• https://github.com/sunnyadn/js-toml/commit/1e45ca56ba12e98508f8aae3e31c4aff7603d711
• https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2

euvd · EUVD-2026-38060

• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq
• https://github.com/sunnyadn/js-toml/commit/1e45ca56ba12e98508f8aae3e31c4aff7603d711
• https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2

nvd · CVE-2026-49293

• https://github.com/sunnyadn/js-toml/commit/1e45ca56ba12e98508f8aae3e31c4aff7603d711
• https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2
• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq

osv · GHSA-wp3c-266w-4qfq

• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-49293
• https://github.com/sunnyadn/js-toml/commit/1e45ca56ba12e98508f8aae3e31c4aff7603d711
• https://github.com/sunnyadn/js-toml
• https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2

• js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.1 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accum… · Advisory content revised · 5 Nov 2026
• CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals · Affected-version evidence changed · 4 Nov 2026
• js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals · Source adds a fixed version · 4 Nov 2026
• js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.1 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accum… · Advisory content revised · 4 Nov 2026