ROOT-APP-NPM-CVE-2026-77465 CVE-2026-77465 in toml - Patched by Root

Root has patched CVE-2026-77465 in the toml package for Root:npm. Multiple fixed versions available...

CVE-2026-85730

creationtimestamp| type| source ---|---|--- 2026-09-09 19:31:51+00:00| seen| https://gist.github.com/alon710/d1e0c342d90c380e5c2e016452073fb0 2026-09-09 20:35:03+00:00| published-proof-of-concept| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

NPM: smol-toml: Denial of Service via malformed TOML documents

NPM: smol-toml: Denial of Service via malformed TOML documents vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.7.0...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

CVE-2026-63376

A flaw was found in toml-node, a software library used for parsing TOML Tom's Obvious, Minimal Language files in Node.js and web applications. A remote attacker could exploit a vulnerability known as prototype pollution by providing specially crafted TOML input. This could allow the attacker to...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...

Linux Distros Unpatched Vulnerability : CVE-2026-77465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose...

Linux Distros Unpatched Vulnerability : CVE-2026-63376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto,...

SUSE CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

Unchecked Input for Loop Condition

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse by supplying a TOML document with a value in an...

CVE-2026-85730

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

A flaw was found in smol-toml, a TOML parser and serializer. A remote attacker could exploit an infinite loop in the parse function by providing a specially crafted TOML document. This occurs when a value within an array or inline table is followed by a comment without a trailing newline...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

Linux Distros Unpatched Vulnerability : CVE-2026-85730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline tabl...

PT-2026-85664

Name of the Vulnerable Software and Affected Versions smol-toml versions prior to 1.7.1 Description The parse function can enter an infinite loop when a value within an array or inline table is followed by a comment that lacks a trailing newline. This occurs in src/util.ts because the skipUntil...