CVE-2026-85730 Details
Description
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
A denial-of-service vulnerability has been identified in the smol-toml library, a TOML parser and serializer, in versions prior to 1.7.1. The issue arises in the parse() function, which can enter an infinite loop when a value in an array or inline table is followed by a comment lacking a trailing newline. This flaw causes the parser to hang indefinitely, consuming excessive CPU resources and disrupting service availability, especially when processing TOML files from untrusted sources.
Users are advised to update to smol-toml version 1.7.1 or later, which fixes the vulnerability by properly handling comments and preventing the parser from entering an infinite loop.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f | [email protected] | Source CodeVendor |
| https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1 | [email protected] | Release NotesVendor |
| https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2 | [email protected] | AdvisoryExploitRemedyVendor |
| https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0 | [email protected] | Content WallTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-606 | Unchecked Input for Loop Condition | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| smol-toml | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |