CVE-2026-85730: smol-toml: Denial of Service via malformed TOML documents
parse() can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment “ends” the document).
The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.
References
- github.com/advisories/GHSA-7w5x-hrqm-74c2
- github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f
- github.com/squirrelchat/smol-toml/releases/tag/v1.7.1
- github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2
- medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0
- nvd.nist.gov/vuln/detail/CVE-2026-85730
Code Behaviors & Features
Detect and mitigate CVE-2026-85730 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →