Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. smol-toml
  4. ›
  5. CVE-2026-85730

CVE-2026-85730: smol-toml: Denial of Service via malformed TOML documents

September 9, 2026

parse() can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment “ends” the document).

The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.

References

  • github.com/advisories/GHSA-7w5x-hrqm-74c2
  • github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f
  • github.com/squirrelchat/smol-toml/releases/tag/v1.7.1
  • github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2
  • medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0
  • nvd.nist.gov/vuln/detail/CVE-2026-85730

Code Behaviors & Features

Detect and mitigate CVE-2026-85730 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.7.1

Fixed versions

  • 1.7.1

Solution

Upgrade to version 1.7.1 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-606: Unchecked Input for Loop Condition
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Source file

npm/smol-toml/CVE-2026-85730.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 10 Sep 2026 00:19:05 +0000.