toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded
    hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before
    reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range.
    Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the
    Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the
    process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This
    issue is fixed in version 5.0.1. (CVE-2026-114144)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded     hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before     reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range.
    Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the     Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the     process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This     issue is fixed in version 5.0.1. (CVE-2026-114144)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476838	SCA: security update for toml (GHSA-9qmh-m7c6-f92p)	Tenable Cloud Security	SCA Checks	Local	high
476838	SCA: security update for toml (GHSA-9qmh-m7c6-f92p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
370255	Linux Distros Unpatched Vulnerability : CVE-2026-114144	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-114144

high

Tenable Plugins

high

high

high