PT-2026-85664 · Npm · Smol-Toml
CVE-2026-85730
·
Published
2026-09-04
·
Updated
2026-09-09
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
smol-toml versions prior to 1.7.1
Description
The
parse() function can enter an infinite loop when a value within an array or inline table is followed by a comment that lacks a trailing newline. This occurs in src/util.ts because the skipUntil() function calls indexOfNewline(), which returns -1 at the end of the input, causing the cursor to reset to the beginning of the string instead of exiting the structure scan. Consequently, the parser hangs indefinitely, potentially consuming the processing capacity of a service when parsing attacker-controlled TOML data.Recommendations
Update smol-toml to version 1.7.1.
Exploit
Fix
DoS
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Smol-Toml