CVE-2026-49293

{"id": "CVE-2026-49293", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49293", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T14:09:42.727540Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sunnyadn", "product": "js-toml", "versions": [{"status": "affected", "version": "< 1.1.1"}]}]}], "published": "2026-06-19T19:16:36.297", "references": [{"url": "https://github.com/sunnyadn/js-toml/commit/1abcb31dc7b1fa88e4c848a8d108891cfbb96fa2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sunnyadn/js-toml/releases/tag/v1.1.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that multiplies a `BigInt` accumulator by the radix once per input digit. Each iteration performs a `BigInt * BigInt` operation on an accumulator that grows linearly with the number of digits already consumed, so the whole loop is O(n\u00b2) in the literal length. The lexer regex places no upper bound on the literal length, so a single TOML document containing one ~500 kB hex literal pins one CPU core for ~40 seconds on a modern laptop (Apple M-series, Node v22). Memory amplification is bounded but CPU amplification is severe and grows quadratically: doubling the literal length quadruples the work. A caller that invokes `load()` on attacker-controlled TOML (configuration upload endpoints, CI/CD systems ingesting third-party `*.toml`, IDE plugins, build tools) is exposed to a single-request CPU exhaustion DoS. Version 1.1.1 fixes the issue."}, {"lang": "es", "value": "js-toml es un analizador TOML para JavaScript, totalmente compatible con la especificaci\u00f3n TOML 1.0.0. Las versiones hasta la 1.1.0 inclusive analizan literales enteros hexadecimales / octales / binarios mediante un bucle parseBigInt escrito a mano que multiplica un acumulador BigInt por la base una vez por cada d\u00edgito de entrada. Cada iteraci\u00f3n realiza una operaci\u00f3n BigInt * BigInt en un acumulador que crece linealmente con el n\u00famero de d\u00edgitos ya consumidos, por lo que todo el bucle es O(n\u00b2) en la longitud del literal. La expresi\u00f3n regular del analizador l\u00e9xico no impone un l\u00edmite superior a la longitud del literal, por lo que un \u00fanico documento TOML que contenga un literal hexadecimal de ~500 kB fija un n\u00facleo de CPU durante ~40 segundos en un port\u00e1til moderno (serie Apple M, Node v22). La amplificaci\u00f3n de memoria est\u00e1 acotada, pero la amplificaci\u00f3n de CPU es grave y crece cuadr\u00e1ticamente: duplicar la longitud del literal cuadruplica el trabajo. Un llamador que invoca load() en TOML controlado por un atacante (puntos finales de carga de configuraci\u00f3n, sistemas CI/CD que ingieren *.toml de terceros, complementos de IDE, herramientas de compilaci\u00f3n) est\u00e1 expuesto a un DoS por agotamiento de CPU de una sola solicitud. La versi\u00f3n 1.1.1 corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sunnyadn:js-toml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9C4EB3F2-9198-41C8-BF40-63A7E2BDFF11", "versionEndExcluding": "1.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}