{"id":"CVE-2026-85730","aliases":["CLSA-2026-1790597280","EUVD-2026-71261","GHSA-7w5x-hrqm-74c2","GHSA-v3rj-xjv7-4jmq","ROOT-APP-NPM-CVE-2026-85730","ROOT-APP-NPM-GHSA-v3rj-xjv7-4jmq"],"status":"published","title":"smol-toml: Denial of Service via malformed TOML documents","description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00524,"percentile":0.44934,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-606","CWE-674","CWE-835"],"published":"2026-03-25T21:03:56Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"npm","package":"smol-toml","fixed_in":["1.7.1","1.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"smol-toml","fixed_in":["1.5.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"smol-toml","fixed_in":["1.6.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/smol-toml","fixed_in":["1.6.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.0"},{"fixed":"1.7.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.2-tuxcare.0"},{"fixed":"1.5.2-tuxcare.1"}]}],"versions":["1.5.2"]},{"source":"osv","ecosystem":"npm","package":"smol-toml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.1"}]}]},{"source":"osv","ecosystem":"npm","package":"smol-toml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/smol-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-root.io.1"}]}]}],"products":[{"vendor":"squirrelchat","product":"smol-toml"}],"references":[{"url":"https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1","tags":["x_refsource_MISC","web"]},{"url":"https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85730","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7w5x-hrqm-74c2"},{"url":"https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-v3rj-xjv7-4jmq","tags":["web"]},{"url":"https://github.com/squirrelchat/smol-toml/releases/tag/v1.6.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v3rj-xjv7-4jmq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85730.json","tags":["advisory"]},{"url":"https://github.com/squirrelchat/smol-toml","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-85730","title":"smol-toml: Denial of Service via malformed TOML documents","description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","status":"published","published":"2026-09-04T15:21:14.948Z","modified":"2026-09-09T16:34:08.718Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-606","CWE-835"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-71261","description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","status":"published","published":"2026-09-04T15:21:14Z","modified":"2026-09-09T16:34:08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:26.437971Z"}],"ghsa":[{"id":"GHSA-7w5x-hrqm-74c2","title":"smol-toml: Denial of Service via malformed TOML documents","description":"### Summary\n`parse()` can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment \"ends\" the document).\n\nThe library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.\n\n### Proof of concept\n\n```js\nimport { parse } from 'smol-toml'\nparse('a=[1 #')   // never returns; CPU pinned at 100%\n```\n\n### Impact\n\nApplications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is **strongly advised** to upgrade to an up-to-date version of the library as soon as possible.\n\nIf your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.\n\n### Patches\n\nVersion 1.7.1 properly breaks out of the loop in these situations and throws the expected `TomlError`.\n\n### Workarounds\n\nNone that don't involve refactors. Update the library **as soon as possible** if your use-case involves parsing arbitrary TOML documents from untrusted sources.\n\n\nReported By : [Ravindu Lakmina Munaweera](https://www.linkedin.com/in/ravindulakmina/)","status":"published","published":"2026-09-09T18:07:11Z","modified":"2026-09-09T18:07:14Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-606","CWE-835"],"updated_at":"2026-11-02T14:41:14.764963Z"},{"id":"GHSA-v3rj-xjv7-4jmq","title":"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines","description":"### Summary\nAn attacker can send a maliciously crafted TOML to cause the parser to crash, because of a stack overflow caused by thousands of consecutive commented lines.\n\nThe library uses recursion internally while parsing to skip over commented lines, which can be exploited to crash an application that is processing arbitrary TOML documents.\n\n### Proof of concept\n```js\nrequire(\"smol-toml\").parse('# comment\\n'.repeat(8000) + 'key = \"value\"')\n```\n\n### Impact\nApplications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input. Downstream users are supposed to properly handle errors in such situations.\n\nDue to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.\n\nAs a reminder, it is **strongly** advised when working with untrusted user input to expect errors to occur and to appropriately catch them.\n\n### Patches\nVersion 1.6.1 uses a different approach for parsing comments, which no longer involves recursion.\n\n### Workarounds\nWrap all invocations of `parse` and `stringify` in a try/catch block when dealing with untrusted user input.","status":"published","published":"2026-03-25T21:03:56Z","modified":"2026-03-25T21:03:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:39:42.712607Z"}],"nvd":[{"id":"CVE-2026-85730","description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","status":"published","published":"2026-09-04T16:18:23.417Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-606","CWE-835"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"CVE-2026-85730","title":"smol-toml: Denial of Service via malformed TOML documents","description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","status":"published","published":"2026-09-04T15:21:14.948Z","modified":"2026-10-28T02:30:46.404479972Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-606","CWE-835"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"GHSA-7w5x-hrqm-74c2","title":"smol-toml: Denial of Service via malformed TOML documents","description":"### Summary\n`parse()` can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment \"ends\" the document).\n\nThe library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.\n\n### Proof of concept\n\n```js\nimport { parse } from 'smol-toml'\nparse('a=[1 #')   // never returns; CPU pinned at 100%\n```\n\n### Impact\n\nApplications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is **strongly advised** to upgrade to an up-to-date version of the library as soon as possible.\n\nIf your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.\n\n### Patches\n\nVersion 1.7.1 properly breaks out of the loop in these situations and throws the expected `TomlError`.\n\n### Workarounds\n\nNone that don't involve refactors. Update the library **as soon as possible** if your use-case involves parsing arbitrary TOML documents from untrusted sources.\n\n\nReported By : [Ravindu Lakmina Munaweera](https://www.linkedin.com/in/ravindulakmina/)","status":"published","published":"2026-09-09T18:07:11Z","modified":"2026-09-09T18:15:04.495290489Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-606","CWE-835"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"GHSA-v3rj-xjv7-4jmq","title":"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines","description":"### Summary\nAn attacker can send a maliciously crafted TOML to cause the parser to crash, because of a stack overflow caused by thousands of consecutive commented lines.\n\nThe library uses recursion internally while parsing to skip over commented lines, which can be exploited to crash an application that is processing arbitrary TOML documents.\n\n### Proof of concept\n```js\nrequire(\"smol-toml\").parse('# comment\\n'.repeat(8000) + 'key = \"value\"')\n```\n\n### Impact\nApplications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input. Downstream users are supposed to properly handle errors in such situations.\n\nDue to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.\n\nAs a reminder, it is **strongly** advised when working with untrusted user input to expect errors to occur and to appropriately catch them.\n\n### Patches\nVersion 1.6.1 uses a different approach for parsing comments, which no longer involves recursion.\n\n### Workarounds\nWrap all invocations of `parse` and `stringify` in a try/catch block when dealing with untrusted user input.","status":"published","published":"2026-03-25T21:03:56Z","modified":"2026-09-10T03:50:41.012864174Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"ROOT-APP-NPM-GHSA-v3rj-xjv7-4jmq","title":"GHSA-v3rj-xjv7-4jmq in smol-toml - Patched by Root","description":"Root has patched GHSA-v3rj-xjv7-4jmq in the smol-toml package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-17T10:20:52Z","modified":"2026-09-17T11:15:03.205112112Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"CLSA-2026-1790597280","title":"TuxCare security update for smol-toml (2 CVEs)","description":"TuxCare rebuilt smol-toml to address 2 CVEs. Fixed in 1.5.2-tuxcare.1.","status":"published","published":"2026-09-28T12:08:00Z","modified":"2026-10-15T09:47:38.063027902Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-NPM-CVE-2026-85730","title":"CVE-2026-85730 in smol-toml - Patched by Root","description":"Root has patched CVE-2026-85730 in the smol-toml package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-17T10:20:52Z","modified":"2026-09-17T11:15:08.448235237Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}