CVE-2026-85730

    Dashboard / Vulnerabilities / CVE-2026-85730

    CVE-2026-85730

    Published: 4 Sept 2026Last Modified: 11 Sept 2026

    Summary: smol-toml: Denial of Service via malformed TOML documents

    Details: smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

    References: https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1, https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85730.json, https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2, https://nvd.nist.gov/vuln/detail/CVE-2026-85730, https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -30f5c367d946b695f379b5d4f0946b2f0a0a8c2f

    Affected versions

    v1.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85730 | CVE-DB