highCVE-2026-85730Sep 9, 2026

CVE-2026-85730: smol-toml Denial of Service via Infinite Loop in Parser

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Feeding smol-toml a TOML array or inline table whose comment has no trailing newline causes the parser to loop forever, pinning the CPU and hanging any Node.js service that processes untrusted input.

Packagesmol-toml
Ecosystemnpm
Affected<= 1.7.0
Fixed in1.7.1
CVE-2026-85730: smol-toml Denial of Service via Infinite Loop in Parser

The problem

smol-toml versions up to and including 1.7.0 contain a denial-of-service vulnerability in the parse() function. An attacker who can supply arbitrary TOML input can hang the process indefinitely with a payload as short as six bytes.

The impact is full availability loss for any service that parses attacker-controlled TOML documents. No authentication or special permissions are required.

Proof of concept

A working proof-of-concept for CVE-2026-85730 in smol-toml, with the exact payload below.

javascript
import { parse } from 'smol-toml'
parse('a=[1 #')   // never returns; CPU pinned at 100%

When the parser scans for the end of an array or inline table and encounters a comment (#) with no trailing newline, skipUntil() in src/util.ts calls indexOfNewline(), which returns -1 at end-of-input. The code then resets the internal cursor to position 0 (start of string) instead of breaking out of the loop, so the scan restarts forever.

The root causes are CWE-606 (unchecked input for loop condition) and CWE-835 (loop with unreachable exit condition). The patch in commit 30f5c367 adds an explicit EOF check inside skipUntil() so that a -1 return from indexOfNewline() breaks the loop and raises a TomlError instead of looping back to offset 0.

The fix

Upgrade smol-toml to version 1.7.1 or later (npm i smol-toml@latest). Version 1.7.1 (commit 30f5c367) fixes skipUntil() to detect end-of-input and throw a TomlError instead of resetting the cursor. There is no viable workaround short of stripping or refusing to parse untrusted TOML before it reaches the library.

Reported by Ravindu Lakmina Munaweera.

References: [1][2][3][4][5][6]

Related research