bigint-buffer-safe

bigint-buffer-safe Safe, pure-JS drop-in replacement for bigint-buffer. Fixes CVE-2025-3194 CVSS 7.5, buffer overflow / DoS. Zero dependencies. No native bindings. Works in Node.js and browsers. Why does this exist? The original bigint-buffer package has a high-severity buffer overflow...

bigint-buffer-js

bigint-buffer-js Drop-in replacement for [email protected] without the native binding. bigint-buffer ≤ 1.1.5 has a buffer overflow in the native toBigIntLE CVE-2025-3194 / GHSA-3gc7-fjrx-p6mg and no fixed version has been published. It is pulled in transitively by @solana/buffer-layout-utils...

Exploit for CVE-2026-109722

CVE-2026-109722: Stale-slots use-after-free Value write Su...

abstract-adapter-utils (>=0.16.0, <=0.19.2), abstract-add-on (>=0.1.0-rc.2, <=0.2.0-beta.3) +674 more potentially affected by unknown CVE via crypto-bigint (>=0.2.5, <=0.7.0-pre.6)

crypto-bigint CARGO version =0.2.5, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.0.1, =0.0.1, =0.0.1, =0.1.0-rc.1, =0.0.1, =0.0.1, =0.14.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0387...

Toml-node: Uncontrolled Resource Consumption (CPU DoS) Via Unbounded-length Integer Literals In Toml.parse()

Summary "toml.parse" converts integer literals hex, octal, binary, and decimal to "BigInt" without first bounding the length of the digit sequence. Since "BigIntstring" construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one...

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

EUVD-2026-107556

toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse...

GHSA-9QMH-M7C6-F92P toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

Summary toml.parse converts integer literals hex, octal, binary, and decimal to BigInt without first bounding the length of the digit sequence. Since BigIntstring construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long...

Linux Distros Unpatched Vulnerability : CVE-2026-114144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114144

The toml-node TOML parser for Node.js and the browser is vulnerable to uncontrolled resource consumption (CPU DoS) in versions prior to 5.0.1 . The toml.parse() function passes unbounded hexadecimal, octal, binary, and decimal sequences from lib/parser.js to BigInt() before the reduceInteger() fu...

CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before reduceInteger in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range...

PT-2026-120813

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before the reduceInteger function in lib/compiler.js verifies if the...

Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain a resource management error vulnerability. This vulnerability arises because toml.parse passes unbounded sequences of hexadecimal, octal, binary, and decimal digits from lib/parser.js to BigInt before performing checks...

Malicious Package

Overview json-bigint-rs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in json-bigint-rs (npm)

Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module namespace, exposes each descriptor's name as an externref global...

MAL-2026-17312 Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...