CLSA-2026-1791282839 TuxCare security update for smol-toml (1 CVE)

TuxCare rebuilt smol-toml to address 1 CVE. Fixed in 1.5.2-tuxcare.2...

PT-2026-115950

TuxCare rebuilt smol-toml to address 1 CVE. Fixed in 1.5.2-tuxcare.2...

smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +993 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R4XH-JQRQ-34V2...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +993 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: GHSA-R4XH-JQRQ-34V2...

GHSA-R4XH-JQRQ-34V2 smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +993 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-SMOLTOML-20537050...

NPM: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

NPM: smol-toml: Quadratic-time parse from parseKey rescanning to end of document on each key line vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.8.0...

CLSA-2026-1790597280 TuxCare security update for smol-toml (2 CVEs)

TuxCare rebuilt smol-toml to address 2 CVEs. Fixed in 1.5.2-tuxcare.1...

ROOT-APP-NPM-GHSA-V3RJ-XJV7-4JMQ GHSA-v3rj-xjv7-4jmq in smol-toml - Patched by Root

Root has patched GHSA-v3rj-xjv7-4jmq in the smol-toml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-85730 CVE-2026-85730 in smol-toml - Patched by Root

Root has patched CVE-2026-85730 in the smol-toml package for Root:npm. Multiple fixed versions available...

PT-2026-99689

Root has patched GHSA-v3rj-xjv7-4jmq in the smol-toml package for Root:npm. Multiple fixed versions available...

CVE-2026-85730

creationtimestamp| type| source ---|---|--- 2026-09-09 19:31:51+00:00| seen| https://gist.github.com/alon710/d1e0c342d90c380e5c2e016452073fb0 2026-09-09 20:35:03+00:00| published-proof-of-concept| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2...

NPM: smol-toml: Denial of Service via malformed TOML documents

NPM: smol-toml: Denial of Service via malformed TOML documents vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.7.0...

@0xsequence/codegenie (>=0.1.0, <=0.5.1), @2h2d/new (>=0.0.2, <=0.1.1-alpha.3) +753 more potentially affected by CVE-2026-85730 via smol-toml (>=1.1.2, <=1.7.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =1.0.0, =4.10.0, =0.1.3, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: CVE-2026-85730 Source advisory: GHSA-7W5X-HRQM-74C2...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

@0xsequence/codegenie (>=0.1.0, <=0.5.1), @2h2d/new (>=0.0.2, <=0.1.1-alpha.3) +753 more potentially affected by CVE-2026-85730 via smol-toml (>=1.1.2, <=1.7.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =1.0.0, =4.10.0, =0.1.3, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: CVE-2026-85730 Source advisory: OSV:GHSA-7W5X-HRQM-74C2...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

SUSE CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...