toml-node CVE-2026-114144

The affected application must call toml-node's toml.parse() on TOML content that an attacker can influence (e.g. uploaded configuration, API/webhook body). No special product feature, flag, or non-default configuration is required - the vulnerable integer path is the parser's default behavior for any hex/octal/binary/decimal integer literal in versions prior to 5.0.1. The exploit requires no authentication (PR:N) and no user interaction (UI:N). The primary limiting factor is input trust: if the TOML parsed is static, operator-supplied, or otherwise trusted, the attacker cannot reach the code path; impact is confined to availability of the single Node.js process/event loop, with no confidentiality or integrity effect.

All signals are internally consistent and point to a genuine but bounded availability risk. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is corroborated by the description and the source-code evidence: toml.parse() feeds unbounded digit sequences to BigInt() in lib/parser.js before reduceInteger() in lib/compiler.js enforces the 64-bit range, so a single crafted document triggers super-linear CPU work that synchronously blocks the Node.js event loop. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC flag in the input, and no EPSS score was provided, so exploitation probability cannot be quantified from the data. The impact is strictly availability (C:N/I:N - no data disclosure or integrity loss), which caps this as a denial-of-service issue rather than a code-execution priority despite the HIGH base score. The practical gating factor, not reflected in the CVSS vector, is that the vulnerable code path only executes when the application passes attacker-influenced TOML to the parser; where TOML input is trusted or operator-supplied only, real-world risk is low. Net: a legitimate patch-soon DoS bug for services that parse untrusted TOML, but not a drop-everything priority absent active-exploitation evidence.

An application uses toml-node (<5.0.1) to parse TOML supplied by untrusted users - for example a config-upload endpoint, a webhook payload, or a multi-tenant build/CI service. The attacker submits a small TOML document containing one extremely long hexadecimal, octal, binary, or decimal integer literal; BigInt() spends super-linear CPU converting it and blocks the single-threaded event loop, stalling all concurrent requests in that process. No public exploit code is identified at time of analysis, but the trigger is trivial to construct from the public advisory and commit diff.