smol-toml: Denial of Service via malformed TOML documents

Published September 9, 2026 CVE-2026-85730

smol-toml can consume a service's processing capacity when it parses specially malformed TOML. The impact is availability only, not passwords or files.

Severity
HighCVSS 4.0 · 8.2
Fix
Fixed in 1.7.1Fix recorded 2 days ago
Affected versions
before 1.7.1
Weakness
CWE-606
Exploit likelihood
0.38% in 30 daysEPSS, higher than 32% of known flaws
Affects
smol-toml

How it works

  • An attacker sends TOML containing a value inside an array or inline table, followed by a comment without a final newline.
  • When the affected parser processes it, the parser enters an endless loop.
  • It can hang indefinitely and consume the service's processing capacity.
  • The application must parse attacker-controlled TOML for this issue to apply.

What to do

Run npm ls smol-toml and compare every installed version with 1.7.1. Versions 1.7.0 or earlier are affected; finding the package alone does not show that malicious input was processed.

Run this in the application environment you want to check:

npm ls smol-toml

Upgrade smol-toml to version 1.7.1 or later, then confirm the dependency tree shows the fixed version. Version 1.7.1 exits the loop and reports a TOML parsing error.

Technical details

CVE-2026-85730 affects smol-toml versions below 1.7.1. When attacker-controlled TOML ends a comment inside an array or inline table, the parser can loop indefinitely and consume service processing capacity. Version 1.7.1 fixes the loop.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source