ROOT-APP-NPM-CVE-2026-77465 CVE-2026-77465 in toml - Patched by Root

Root has patched CVE-2026-77465 in the toml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root

Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...

CVE-2026-85730

creationtimestamp| type| source ---|---|--- 2026-09-09 19:31:51+00:00| seen| https://gist.github.com/alon710/d1e0c342d90c380e5c2e016452073fb0 2026-09-09 20:35:03+00:00| published-proof-of-concept| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2...

@0xsequence/codegenie (>=0.1.0, <=0.5.1), @2h2d/new (>=0.0.2, <=0.1.1-alpha.3) +836 more potentially affected by CVE-2026-85730 via smol-toml (>=1.1.2, <=1.7.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =1.0.0, =4.10.0, =0.1.3, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: CVE-2026-85730 Source advisory: OSV:GHSA-7W5X-HRQM-74C2...

NPM: smol-toml: Denial of Service via malformed TOML documents

NPM: smol-toml: Denial of Service via malformed TOML documents vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.7.0...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

SUSE CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-63376

A flaw was found in toml-node, a software library used for parsing TOML Tom's Obvious, Minimal Language files in Node.js and web applications. A remote attacker could exploit a vulnerability known as prototype pollution by providing specially crafted TOML input. This could allow the attacker to...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...

Linux Distros Unpatched Vulnerability : CVE-2026-63376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto,...

Linux Distros Unpatched Vulnerability : CVE-2026-77465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose...

SUSE CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

@0xsequence/codegenie (>=0.1.0, <=0.5.1), @2h2d/new (>=0.0.2, <=0.1.1-alpha.3) +836 more potentially affected by CVE-2026-85730 via smol-toml (>=1.1.2, <=1.7.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =1.0.0, =4.10.0, =0.1.3, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: CVE-2026-85730 Source advisory: SNYK:JS-SMOLTOML-19643959...

Unchecked Input for Loop Condition

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse by supplying a TOML document with a value in an...

CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

A flaw was found in smol-toml, a TOML parser and serializer. A remote attacker could exploit an infinite loop in the parse function by providing a specially crafted TOML document. This occurs when a value within an array or inline table is followed by a comment without a trailing newline...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...