The vulnerability resides in the toml-node parser, where large hexadecimal, octal, binary, or decimal literals are passed to the JavaScript BigInt constructor before a range check is performed. Converting such an unbounded integer consumes super‑linear CPU time and blocks the Node.js event loop synchronously, allowing an attacker who can supply a crafted TOML document to exhaust computational resources of the process and prevent other tasks from running.

BinaryMuse’s toml-node library is affected. All releases prior to version 5.0.1 contain the flaw because the unsafe conversion logic executes before any bounds checking; version 5.0.1 and later include a fix that performs the range validation before calling BigInt.

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service risk, while the EPSS score of less than 1 % shows a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any scenario where an attacker can provide arbitrary TOML input to the application, such as through a configuration file, user‑supplied data, or an external API that parses TOML. If the parsing function is exposed to untrusted data, the flaw can be triggered without authentication; the event loop remains blocked until the BigInt conversion completes, causing a denial of service for the entire Node.js process.