barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-49293 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-49293 Source advisory: OSV:GHSA-WP3C-266W-4QFQ...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-49293 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-49293 Source advisory: SNYK:JS-JSTOML-17728419...

CVE-2026-49293

creationtimestamp| type| source ---|---|--- 2026-06-22 05:14:35+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mou4vxh2ex2c 2026-06-27 00:35:47+00:00| published-proof-of-concept| https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq...

CVE-2026-49293

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit. Each iteration...