{"action":"Upgrade js-toml to 1.1.1 or later.","affected":[{"fixed":"1.1.1","introduced":"0"}],"component":"js-toml","cve_ids":["CVE-2026-49293"],"ecosystem":"npm","epss":0.00644,"exploited":false,"fixed_versions":["1.1.1"],"ghsa_id":"GHSA-wp3c-266w-4qfq","id":"tcs_01M5KGFGM856VFGKVGHW2TQX2Y","modified_at":"2026-06-26T22:41:27.037839Z","published_at":"2026-06-26T22:21:43Z","references":["https://osv.dev/vulnerability/GHSA-wp3c-266w-4qfq","https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq","https://nvd.nist.gov/vuln/detail/CVE-2026-49293","https://github.com/sunnyadn/js-toml/commit/1abcb31dc7b1fa88e4c848a8d108891cfbb96fa2","https://github.com/sunnyadn/js-toml","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wp3c-266w-4qfq","url":"https://osv.dev/vulnerability/GHSA-wp3c-266w-4qfq"}],"summary":"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals"}