CVE-2026-85730: smol-toml Denial of Service Vulnerability
HIGHCVE-2026-85730 is a HIGH denial of service vulnerability (CWE-606: Unchecked Input for Loop Condition) affecting smol-toml libraries in the npm ecosystem. The issue involves denial of service via malformed toml documents. Remediation is available by upgrading affected packages to version 1.7.1.
CVE-2026-85730 at a Glance
How to Fix CVE-2026-85730
To remediate this vulnerability, upgrade all affected smol-toml dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install smol-toml@1.7.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls smol-tomlHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-85730, inspect your project dependencies using npm:
npm ls smol-tomlAnalyze the terminal output to locate any version of smol-toml in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.7.1), your application is affected.
Note: The npm ls smol-toml command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-606: Unchecked Input for Loop Condition, where the product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. In smol-toml, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-85730 Affected smol-toml Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
smol-toml
|
npm |
< 1.7.1
|
1.7.1
|
References
Frequently Asked Questions
What is CVE-2026-85730?
Which smol-toml versions are affected?
What version fixes CVE-2026-85730?
Is smol-toml affected?
What CWE is associated with CVE-2026-85730?
How can I check npm dependencies for CVE-2026-85730?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7w5x-hrqm-74c2",
"modified" : "2026-09-09T18:07:12Z",
"published" : "2026-09-09T18:07:11Z",
"aliases" : [ "CVE-2026-85730" ],
"summary" : "smol-toml: Denial of Service via malformed TOML documents",
"details" : "### Summary\n`parse()` can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment \"ends\" the document).\n\nThe library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.\n\n### Proof of concept\n\n```js\nimport { parse } from 'smol-toml'\nparse('a=[1 #') // never returns; CPU pinned at 100%\n```\n\n### Impact\n\nApplications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is **strongly advised** to upgrade to an up-to-date version of the library as soon as possible.\n\nIf your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.\n\n### Patches\n\nVersion 1.7.1 properly breaks out of the loop in these situations and throws the expected `TomlError`.\n\n### Workarounds\n\nNone that don't involve refactors. Update the library **as soon as possible** if your use-case involves parsing arbitrary TOML documents from untrusted sources.\n\n\nReported By : [Ravindu Lakmina Munaweera](https://www.linkedin.com/in/ravindulakmina/)",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "smol-toml"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.7.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.7.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-85730"
}, {
"type" : "WEB",
"url" : "https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/squirrelchat/smol-toml"
}, {
"type" : "WEB",
"url" : "https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1"
}, {
"type" : "WEB",
"url" : "https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-606", "CWE-835" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-09-09T18:07:11Z",
"nvd_published_at" : "2026-09-04T16:18:23Z"
}
}