CVE-2026-49293 — CPU exhaustion via O(n²) BigInt construction on radix-prefixed integer literals

js-toml versions up to and including 1.1.0 may be vulnerable to CPU exhaustion when load() processes attacker-controlled TOML input. The hand-written conversion of very long hexadecimal, octal, or binary integer literals has O(n²) complexity. The source rates the impact as high for attacker-controllable input and low when the calling application limits TOML to small documents below 1 kB.