CVE-2026-85730 in smol-toml
Summary
by MITRE • 09/04/2026
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The smol-toml library, recognized for its performance and correctness as a TOML parsing solution, contains a critical logic flaw that leads to denial of service conditions under specific input scenarios. The vulnerability resides within the core parsing mechanism, specifically in how the parser handles comments following array or inline table values when those inputs lack a trailing newline character. This issue stems from an incorrect boundary check implementation in the utility functions responsible for navigating through text content during deserialization processes.
The technical root cause is located in the skipUntil function found within src/util.ts. When this function attempts to locate the next newline character using indexOfNewline, it returns -1 if no such character exists before the end of the input string. Instead of treating this as a terminal condition that should halt parsing or raise an appropriate error, the code erroneously resets the cursor position back to the beginning of the string. This logic error creates a state where the parser believes there is more content to process and immediately begins scanning from the start again without advancing past the problematic section.
This reset mechanism triggers an infinite loop because the same invalid input pattern persists at every iteration. The parser continuously resets its position, re-evaluates the same segment of data, fails to find a newline, receives -1 once more, and repeats the cycle indefinitely. This behavior effectively locks up any thread or process executing this parsing operation, leading to a complete consumption of available processing capacity on the host system.
From an operational perspective, this vulnerability poses a significant risk to applications that accept user-supplied TOML data for configuration or serialization purposes. An attacker can craft maliciously formatted TOML payloads containing arrays or inline tables followed by comments without trailing newlines to trigger this infinite loop remotely if the service is exposed via network interfaces. The resulting denial of service prevents legitimate users from accessing services, disrupts automated workflows relying on configuration parsing, and may lead to resource exhaustion in containerized environments where CPU limits are enforced but not strictly capped against unbounded loops.
This flaw aligns with CWE-835, which describes looping issues that result in excessive consumption of resources or denial of service conditions. It also maps to the ATT&CK technique T1499, specifically endpoint denial of service via resource exhaustion through software vulnerabilities. The lack of proper input validation and boundary checking allows a simple syntactic anomaly to escalate into a severe availability impact.
The recommended mitigation is straightforward for application developers: upgrade immediately to version 1.7.1 or later of the smol-toml library, where this logic error has been corrected. For systems unable to update instantly due to dependency constraints, implementing input sanitization layers that reject TOML structures lacking proper termination characters can provide a temporary workaround. Additionally, deploying runtime protection mechanisms such as CPU usage monitoring and automatic process restarts upon detecting prolonged high utilization can mitigate the impact of exploitation attempts until permanent remediation is applied.