npm toml High-Severity Denial-of-Service Vulnerability CVE-2026-114144

The npm toml package contains a high-severity denial-of-service vulnerability identified as CVE-2026-114144. According to GitHub advisory GHSA-9qmh-m7c6-f92p, the flaw exists in versions 5.0.0 and earlier. The issue stems from how the library handles integer literals during the parsing process. Attackers can exploit this by supplying a small, well-formed TOML document that causes the Node.js event loop to hang.

The risk

The vulnerability arises because `toml.parse()` converts integer literals to `BigInt` without first limiting the length of the digit sequence. This applies to hex, octal, binary, and decimal formats. Since constructing a `BigInt` from a very long numeric string runs in super-linear time, a single long integer literal can pin a process's CPU at 100 percent. This results in a denial of service for any application parsing attacker-supplied or third-party TOML data.

Who is exposed

Any application using npm toml version 5.0.0 or lower is exposed to this risk. The advisory notes that no authentication or complex crafting is required to trigger the flaw. Environments that accept TOML configuration files from external sources or untrusted users are particularly vulnerable. The parser’s existing nesting-depth limit does not protect against this specific vector, as it only bounds structural nesting rather than scalar token length.

Cost and compliance

The source material does not provide specific financial cost estimates or regulatory compliance implications for this vulnerability. The advisory focuses on the technical mechanism and the availability of a patched version. Organizations should assess their exposure based on their use of the affected package versions and their data ingestion practices. No further compliance details are stated in the provided source material.

What to watch

Security teams should verify their current npm toml package version immediately. If they are running 5.0.0 or earlier, they should plan to update to 5.0.1. Monitoring application performance logs for sudden CPU spikes during TOML parsing operations can help identify potential exploitation attempts before they cause significant downtime.

Signals worth monitoring

Teams usually observe sustained high CPU utilization on Node.js processes when this type of algorithmic complexity attack occurs. Check whether application logs show parsing timeouts or hangs specifically associated with TOML file ingestion. Monitor for incoming requests containing unusually large numeric strings within configuration payloads. First containment moves often involve restarting affected services to clear the blocked event loop and blocking the specific malicious payload patterns at the network edge if possible.

What to do and how to stay safe: npm

• Audit your Node.js projects to identify if npm toml version 5.0.0 or earlier is installed.
• Update to npm toml version 5.0.1 once the vendor provides an update to mitigate the risk.
• Monitor server CPU usage for sudden spikes that correlate with TOML parsing activities.
• Review input validation rules to ensure external TOML files are scanned before processing.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this npm toml vulnerability?

The vulnerability is identified as CVE-2026-114144.

Which versions of npm toml are affected?

Versions 5.0.0 and earlier are vulnerable to this high-severity denial-of-service flaw.

Is there a patch available for CVE-2026-114144?

Yes, version 5.0.1 of the npm toml package patches this vulnerability.