CVE-2026-85730

creationtimestamp| type| source ---|---|--- 2026-09-09 19:31:51+00:00| seen| https://gist.github.com/alon710/d1e0c342d90c380e5c2e016452073fb0 2026-09-09 20:35:03+00:00| published-proof-of-concept| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

NPM: smol-toml: Denial of Service via malformed TOML documents

NPM: smol-toml: Denial of Service via malformed TOML documents vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.7.0...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

Unchecked Input for Loop Condition

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse by supplying a TOML document with a value in an...

CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

A flaw was found in smol-toml, a TOML parser and serializer. A remote attacker could exploit an infinite loop in the parse function by providing a specially crafted TOML document. This occurs when a value within an array or inline table is followed by a comment without a trailing newline...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

PT-2026-85664

Name of the Vulnerable Software and Affected Versions smol-toml versions prior to 1.7.1 Description The parse function can enter an infinite loop when a value within an array or inline table is followed by a comment that lacks a trailing newline. This occurs in src/util.ts because the skipUntil...

Linux Distros Unpatched Vulnerability : CVE-2026-85730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline tabl...

@actinc/eslint-config (>=4.10.0, <=4.16.0), @alexgorbatchev/dotfiles (>=0.0.1, <=1.0.4) +300 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.6.0)

smol-toml NPM version =1.1.2, =4.10.0, =0.0.1, =2.8.0, =0.1.0-alpha.0, =0.1.3, =0.1.3, =0.1.3, =0.2.2, =0.32.3, =0.2.2, =1.0.0, =0.2.0, =0.0.4, =0.0.4, =0.0.4, =9.0.0-canary.1784 and more Source cves: unknown CVE Source advisory: OSV:GHSA-V3RJ-XJV7-4JMQ...

@actinc/eslint-config (>=4.10.0, <=4.16.0), @alexgorbatchev/dotfiles (>=0.0.1, <=1.0.4) +300 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.6.0)

smol-toml NPM version =1.1.2, =4.10.0, =0.0.1, =2.8.0, =0.1.0-alpha.0, =0.1.3, =0.1.3, =0.1.3, =0.2.2, =0.32.3, =0.2.2, =1.0.0, =0.2.0, =0.0.4, =0.0.4, =0.0.4, =9.0.0-canary.1784 and more Source cves: unknown CVE Source advisory: SNYK:JS-SMOLTOML-15768230...

Uncontrolled Recursion

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Uncontrolled Recursion. An attacker can cause the application to crash by submitting TOML documents containing thousands of consecutive commented lines, which triggers...

GHSA-PQHP-25J4-6HQ9 smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables

Summary An attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects. The library does not limit the maximum exploration depth while...

@alexlit/config-markdownlint (2.8.0), @cluenar/tools (>=1.0.0, <=2.0.1) +57 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.3.0)

smol-toml NPM version =1.1.2, =1.0.0, =3.0.0, =4.2.1-alpha.1, =0.0.0, =1.1.0, =0.2.7, =1.0.10, =7.6.4-next.39, =7.6.4-next.39, =7.6.4-next.39, =7.6.4-next.39, =7.6.4-next.39, =9.0.0-canary.257 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PQHP-25J4-6HQ9...

PT-2024-40409 · Npm · Smol-Toml

Name of the Vulnerable Software and Affected Versions: smol-toml versions prior to 1.3.1 Description: The issue arises from the library's lack of limitation on the maximum exploration depth while parsing or producing TOML documents, allowing an attacker to cause a stack overflow by sending a...